DiffVax: Optimization-Free Image Immunization Against Diffusion-Based Editing
Authors: Tarik Can Ozden
Ozgur Kara
Oguzhan Akcin
Kerem Zaman
Shashank Srivastava
Sandeep P. Chinchali
James Matthew Rehg
Venue: ICLR 2026 Poster (2026)
Keywords: diffusion
malicious editing
immunization
defense against editing
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: We introduce DiffVax, an end-to-end framework for training an "immunizer model" that learns how to generate imperceptible perturbations to immunize target images against diffusion-based editing.

Abstract: Current image immunization defense techniques against diffusion-based editing embed imperceptible noise into target images to disrupt editing models. However, these methods face scalability challenges, as they require time-consuming optimization for each image separately, taking hours for small batches. To address these challenges, we introduce DiffVax, a scalable, lightweight, and optimization-free framework for image immunization, specifically designed to prevent diffusion-based editing. Our approach enables effective generalization to unseen content, reducing computational costs and cutting immunization time from days to milliseconds, achieving a speedup of 250,000x. This is achieved through a loss term that ensures the failure of editing attempts and the imperceptibility of the perturbations. Extensive qualitative and quantitative results demonstrate that our model is scalable, optimization-free, adaptable to various diffusion-based editing tools, robust against counter-attacks, and, for the first time, effectively protects video content from editing. More details are available in https://diffvax.github.io/.

Published as a conference paper at ICLR 2026
DIFF OPTIMIZATION-FREE IMAGE IMMUNIZA- TION AGAINST DIFFUSION-BASED EDITING
Tarik Can Ozden'
Ozgur Kara* UICC
Oguzhan Akcin
Kerem Zaman UNC Chapel Hill
UIUC
UT Austin
Shashank Srivastava UNC Chapel Hill
Sandeep P. Chinchali UT Austin
James M. Rehg UIUC
Edized Immunised Image
Edited Immunised Imaage
Original Image
Image
Original Image
Edited Image
an eagle sitlnn cable in library'
(a) Unseen Images
"In a prison"
"eeoffrey Hinson political procese"
sunglasses
Original Video
(b) Unseen Video
"Yoahua Bengio in courtroam
Edited
Video
Edited
Immuniaed
Video
Frames arranged chromological order
Figure I: DiffVax is an optimization-frre image immunization approach designed to protect im- ages and videos from diffusion-based editing. DiffVar demonstrates robustness across diverse content, providing protection for both in-the-wild (a) unseen images and (b) unseen video con- tent while effectively preventing edits across various editing methods, including inpainting (illus- trated with a human in the left column and a non-human foreground object in the right column) and instruction-basee edits (right column) with InstructPix2Pis (Brooks et al., 2023).
ABSTRACT
Current image immunization defense techniques against diffusion- -based editing embed imperceptible noise into target images to disrupt editing models. How- ever, these methods face scalability challenges, as they require time-consuming optimization for each image separately, taking hours for small batches. To ad- dress these challenges, we introduce Di DiffVax, a scalable, lightweight, and optimization-free framework for image immunization, specifically designed prevent diffusion-baar based editing. Our approach enables effective generalization to unseen content, reducing computational costs and cutting immunization time from days to milliseconds, achieving speedup of 250,000x This is achieved through a loss term that ensures the failure of editing attempts and the imperceptibility of the perturbations. Extensive qualitative and quantitative results demonstrate that our model is scalable, optimization -free adaptable various diffusion saffue editing tools, robust against counter-attacks, and, for the first time, effectively protects video content from editing. More details are available our Project Webpage.
Equul contribution

---

Published as a conference paper at ICLR 2026
INTRODUCTION
Recent advancements in generative models, particularly diffusion models (Sohl-Dicksteil et al., 2015; Ho et al., 2020; Rombach et al., 2022), have enabled realistic content synthesis, which can be used for various applications, such as image generation (Saharia et al., 2022; Ruiz et al., 2023;
Chefer al., 2023; Zhang et al., 2023c; Li et al., 2023b; Mou et al., 2024b; Bansal et al., 2023) and editing (Brooks et al., 2023; Couairon et al., 2023a; Hertz et al., 2023b; Meng et al., 2022). However, the widespread availability and accessibility of these models introduce significant risks, as malicious actors exploit them produce deceptive, realistic content known deepfakes (Pei et al., 2024). Deepfakes pose severe threats across multiple domains, from political manipulation (Appel & Prietzel, 2022) and blackmail (Blancaflor al., 2024) to biometric fraud (Wojewidka, 2020) and compromising trust in legal processes (Delfino, 2022). Furthermore, they have become tools for sexual harassment through the creation of non-consensual explicit content (Jean Mackenzie, 2024; Davies& & McDermott, 2022: Cole, 2018). Given the widespread accessibility of diffusion models, the scale of these threats continues grow, underscoring the urgent need for robust defense mechanisms to protect individuals, institutions, and public trust from such misuse.
To address these challenges, one line of research has focused on deepfake detection (Naitali al., 2023; Passos et al., 2024) and verification methods (Hasan & Salah, 2019), which facilitate post-hoc identification. While effective for detection, these approaches do not proactively prevent malicious editing, as they only identify it after it happens. Another branch modifies the parameters of editing models (Li et al., 2024) to prevent unethical content synthesis (e.g. NSFW material); however, the widespread availability of unrestricted generative models limits its effectiveness. A more robust de- fense mechanism, known as image immunization (Salman et al., 2023; Lo et al., 2024; Yeh et al., 2021: Ruiz et al., 2020), safeguards images from malicious edits by embedding imperceptible adver- sarial perturbation. This approach ensures that any editing attempts lead to unintended or distorted results, proactively preventing malicious modifications rather than depending on post-hoc detection. The subtlety of this protection is particularly valuable for large-scale, publicly accessible content, such as social media, where user data is especially vulnerable to malicious attacks. By uploading immunized images instead of the original ones, users can reduce the risk of misuse by malicious actors, highlighting the potential of immunization- based methods for real-world impact.
However, current immunization approaches remain inadequate, as they do not simultaneously sat- isfy the key requirements of an effective defense: (i) scalability for large-scale content, (ii) memory and runtime efficiency. and (iii) robustness against counter-attacks. PhotoGuard (Salman et al., 2023) (PG) embeds adversarial perturbations into target images to disrupt components of the dif- fusion model by solving constrained optimization problem via projected gradient descent (Madry et al., 2018a). 8a). Although PhotoGuard was the first immunization model targeting diffusion-based editing, it requires over 10 minutes of runtime per image and at least 15GB of memory, causing both computational and time inefficiency. To alleviate these demands, DAYN (Lo et al., 2024) proposes a semantic- based attack that disrupts the diffusion model's 's attention mechanism during editing. While this approach reduces computational load, it remains time-inefficient like PhotoGuard, as it requires separate optimization process for each image and cannot generalize to unseen content. Further- more, both approaches are vulnerable to counter-attacks, such as denoising the added perturbation or applying JPEG compression SSnndvval-Segur neither method is practical for large-scale applications, such as safeguarding the vast volume of image and video data uploaded daily on social media platforms.
al., 2023) the immunized image. Consequently,
To address these challenges, we introduce D DiffVax, an end-to-end framework for training an "im- munizer model" that learns how to generate imperceptible perturbations to immunize target images against diffusion-based editing (see Fig 2). This immunization process ensures that any attempt to edit the immunized image using a diffusion-basee prior works in ensuring editing failure, and it demonstrates the fcasibility and generalizability of the imagc-conditioned feedwrd approach to perturbation generation.
model fails. Di f fVax is more effective than
Our training process is guided by two objectives, expressed as separate terms in the loss function: (1) encouraging the model to generate an imperceptible perturbation, and (2) ensuring that any editing attempt the immunized image fails. Our trained immunizer operates with a single forward pass, completed within milliseconds, climinating the need for time- intensivt per-image optimization. This efficiency enables scalability to high-volume content protection. Additionally, D f fVax enhances
2

---

Published as a conference paper at ICLR 2026
optiniation lancice
Orggral
Tiractiqe
Ldtred Image
Orggna
Inmrsnoad leage Y
Thranap
Baled Exange
lo peppoie 2t Dioess studit
Inage
Prodace pertatbaiin for euch imsage squeraily. (10+ minaazoiraae)
persen is Glass stacie"
(a) Malicious Editing
(b) Protection with Existing Approaches
Immunion f(:9)
Defender with DietVax
Attacker
fewaad
with raised
taneeber
Origiaal
Inarensol tmage D
Trznstapa
Inmrated Image
tech
Cuss
Prodace perteraation instunlly for any image (-70 millsaccoddimmag)
Train Immunizer Model
TTee and ircnelattion
Protection
Gse caads voa Aileeend
Comparing DifEVax with existing approaches. (a) An attacker performs malicious editing on an original image. (b) Existing defenses immunize images by solving a costly optimiza- tion problem for each image individually, taking over 10 minutes per image. (c) DiffVax enables scalable protection by first training an immunizer model (green box) on diverse dataset. Once trained, the model can immunize unseen images with single forward pass, producing effective perturbations in approximately 70 milliseconds per image.
Figure 2:
memory efficiency by avoiding gradient computation during inference, setting it apart from prior methods. It also exhibits robustness against common counter-attacks, such as JPEG compression and image denoising (Sandoval-Segge -Seuura et al., 2023). In addition, our framework demonstrates superior generalization with other diffusion-ben based editing methods (see Fig. for examples on inpainting and instruction-based editing). Leveraging these strengths, we extend immunization video content for the first time, achieving results previously unattainable due to the computational limitations of earlier approaches. As result, Di f fVax satisfies all key requirements for effective defense.
To summarize, our contributions are as follows:
We are the first to introduce a training framework in which the model learns to effectively immunize a given image against diffusion-basee editing, drastically reducing inference time from days to milliseconds and enabling real-time protection.
Thanks its computational efficiency, our model shows promising potential as a founda- tional step toward immunizing video content.
Unlike prior methods that require per-image optimization and therefore cannot general- ize to unseen data, our approach enables generalization new content through a learned "image immunizer".
Di faax achieves superior results with substantial degradation of the editing operation, and minimal memory requirement, demonstrating resistance counter-attacks, making the fastest, most cost-effective, and robust method available.
RELATED WORK
Adversarial attacks Adversarial attacks exploit model vulnerabilities by introducing perturbations that induce misclassification. Early bradeent-based methods efficiently generated such examples via gradient manipulation (Goodfellow et al., 2015; Madry et al., 2018b), later refined to minimize per- ceptual distortion (Carlini & Wagner, 2017: Moosavi-Dezfore et al., 2016). Generative approaches advanced these attacks by synthesizing realistic adversarial inputs (Xiao et al., 2018). Subsequent work improved transferability and query efficiency using momentum and random search (Dong et al., 2018; Andriushchenko et al., 2020), while ensemble-based methods strengthened robustness evaluation (Croce & Hein, 2020). Universal perturbations Danezis, 2018) and generative perturbation networks (Poursaeed et al., 2018) further generalized at- tacks across data and models. Building on these advances, our work focuses on immunizing against diffusion- based editing, addressing its unique characteristics.
Deoosvi-Dezzoolii et al., 2017; Hayes &
3

---

Published as a conference paper at ICLR 2026
Preventing image editing The proliferation of Latent Diffusion Models (LDMs) has underscored the demand for robust immunization strategies against unauthorized image manipulation. Initial efforts focused on Generative Adversarial Network (GAN)-based models, employing adversarial perturbations to inhibit edits (Yeh et al., 2021; Aneja et al., 2022). PhotoGuard (Salman et al., 2023) extended this line of work to diffusion models via encoder- and model-level perturbations but in- curred substantial computational overhead due to backpropagation across multiple timesteps. To alleviate this, Lo et al. (2024)' proposed an atlention-disruption strategy that bypasses full gradient computation, though its reliance on fixed prompts limits robustness. DiffusionGuard (Choi et al., 2025) enhances PhotoGuard by optimizing over augmented masks, yet remains computationally in- tensive. Similarly, PCA (Guo et al., 2024) proposes grey-box attack by inducing posterior collapse in the VAE encoder to disrupt editing. Addressing instruction-guidee et al., 2023) introduces perturbations to shift latent representations, causing semantic mismatches in the edited output. Mcanwhile, Shih et al. (2025) bypass the reliance on VAE encoders by proposing feature-based attack effective against pixel-domain diffusion models. Other approaches, including Mist (Liang & Wu, 2023), AdvDM (Liang et al., 2023), SDS (Xue et al., 2024), and Glaze (Shan et al., 2023), target tott-to-mmagee diffusion fine-tuned models, but exhibit high computational de- mands and limited resilience to adaptive attacks. In contrast, Di Vaxx introduces a model-agnostic immunizer that generalizes to unseen data via single forward pass. Furthermore, we present, for the first time, promising results in the direction of video immunization.
editing, EditShield (Chen
Diffusion- image editing Diffusion models have emerged as powerful tools for image edit- ing tasks such as inpainting (Wang et al., 2023; Lugmayr et al., 2022; Zhang et al., 2023a), style transfer (Wang et al., 2023; Mou al.. 2024a; Yang et al., 2023; Hertz et al., 2023a), and text- guided transformations (Brooks et al., 2023; Lin et al., 2024; Ravi et al., 2023), by conditioning on prompts or image regions. Edits are guided through attention manipulation (Parmar et al.. 2023) and multi-step noise prediction. Approaches include both training-based (Couairon et al., 2023b; Kim et al., 2022) and training-free methods (Mokady et al., 2023; Miyake et al., 2023) requiring minimal fine-tuning. We use stable diffusion inpainting our primary editing model and include results with InstructPix2Pix (Brooks et al., 2023) to show model model-agnostic performance.
3 METHODOLOGY
3.1 PRELIMINARIES
Image immunization Adversarial attacks exploit the vulnerabilities of machine learning models by introducing small, imperceptible perturbations to input data, causing the model to produce incorrect or unintended outputs (Szegedy et al., 2014; Biggio al., 2013). In the context of diffusion models, such perturbations can be crafted to disrupt the editing process, ensuring that attempts to modify an adversarially perturbed image fail to achieve intended outcomes. Given an image I, the goal is to transform it into an adversarially immunized version, Iim. by introducing a perturbation eim:
Iim
I+ fims
subject to:
[[emalls < K.
(1)
where xn is the perturbation budget that constrains the norm of the perturbation to ensure that it remains imperceptible. The norm p could be chosen as 1, 2, or oc, depending on the application.
Latent diffusion models LDMs (Rombach et al., 2022) perform the generative process in lower- dimensional latent space rather than pixel space, achieving computational efficiency while maintain- ing high-quality outputs. This design is ideal for large-scale tasks like image editing and inpainting. Training an LDM starts by encoding the input image I, into a latent representation 2n E(Lo) using encoder E-)) The diffusion process operates in this latent space, adding noise over T steps to generate a sequence ø1,- ,., 2T, with 2++1 = /1 3r 2t + /Be 6t, é ~ (O, I), where 3, the noise schedule step t. The training aims to learn denoising network eq that predicts the added noise e, by minimizing L(0) = E=,20.-~AA0.)) [|]e - cœ(z,, (2.,t)] t)]] In the reverse process, a noisy latent vector 2T (O I) is iteratively denoised via the trained denoising network to recover 20. which is decoded into the final image I = (20)) with decoder D(.).
Cooee unavailable despite request.
4

---

Published as a conference paper at ICLR 2026
(4) F'ddit-Fad Trinnng Fromeoor
(b) Inference
Falemar
Fi
Pronuct
Figure 3: Overview of DiffVax Our end-to-end training framework is illustrated in (a). The training process consists of two stages. In Stage immunization is applied to the training image I. In Stage 2, the immunized image Iim is edited using stable diffusion model SD(.) with the specified text prompt and mask, during which the Lnoise and Lodit are computed. During inference (b), the trained immunizer model generates immunization noise (see Inference Stage in (b)) applied to the original (target) image using an immunization mask. When a malicious user attempts to attack these immunized images with an editing mask, the editing tool (see Inference Stage 2 in (b)) is unable to produce the intended edited content.
3.2 PROBLEM FORMULATION
Let I E ##x represent an image with height H, width W, and C' color channels. A malicious user using diffusion-based editing tool, SD(-), attempts maliciously edit the image based on a prompt P and a binary mask M E {0, 1] WxC which defines the target area for editing, with a value of indicating the region of interest and 0 denotes the background or irrelevant areas. Ideally, this target region can represent any meaningful part of the image, such as a human body or a face. Our objective is to immunize the original (target) image by carefully producing a noise (a) Cim remains imperceptible to the user, and (b) the edited immunized image Lim.edit fails to accurately reflect the prompt P applied by the malicious users. In other words, the immunized image disrupts the editing model SD(-) such that any attempt to edit the image results in unsuccessful or unintended modifications. While our approach is broadly applicable to any diffusion-based editing tool, such as inpainting models and InstructPix2Pix (Brooks et al., 2023), this study follows previous work (Salman et al., 2023; Lo et al., 2024) by using inpainting as the primary editing tool for problem formulation and quantitative experiments. We focus on scenarios where the sensitive regions such as human body or face remains constant, with other areas considered editable, reflecting real-world malicious editing scenarios. Additional results for other objects and tools (c.g. InstructPix2Pix) are provided in Fig. 1, Fig. 4, and in our Appendix A.2.
<im that satisfies two key criteria:
3.3 OUR APPROACH
End-to-end training framework To overcome the speed limitations of previous methods, which require solving an optimization problem independently for each image, we propose an end-to-end training framework. This framework enables an immunizer model f=: to instantly generate im- munization noise for given input image. Our training algorithm (see Appendix A.I, and Fig. 3 (a)) consists of two stages. In the first stage, we employ a UNet++ (Zhou et al., 2018) architecture for the "immunizer" model f(::0), which takes an input image I and generates the corresponding immunization noise Cim- Subsequently, Gim multiplied by the immunization mask M, which tar- gets the region of interest (e.g. a person's 's face). The resulting masked noise is then added to the training image to produce the immunized image, computed as Iim = I Eim O M. Finally, the image is clamped to the [0, range. To ensure the noise remains imperceptible to the human eye, we introduce the following loss: Cnoise
I) O M
Sum(M)
M
where p is empirically chosen to be 1. Luoise penalizes deviations within the masked region, ensuring that the change between the immunized image and the training image is imperceptible. In the second stage, after generating the immunized image Im-- we apply diffusion- editing using the editing tool SD(-). This model takes the immunized image Iim the training mask M, and the training prompt P as input, performing edits in the regions specified by the mask. To ensure that the edited image is effectively distorted, we define the loss function:
1
Ledit sum ~ M)
|D ~ M,P) (~ M)
(3)
5

---

Published as a conference paper at ICLR 2026
Edited
Edited Immmnnized Image
Original Image
Edited Imaaee
Immunized Image
Original Image
Edited Image
(() Seen Images
"watching
theater
performance"
(IastroctPscPPic)
(Eepaiming)
(b) Unseen
Imaaee
garage"
museum"
(c) Unseen Video
Original
Video
"under
Edited
Video
Edited
Immunised
Video
Frames arranged in chronological order
Figure 4: Qualitative results with DiffVax Our method effectively immunizes (a) seen images and generalizes to (b) unseen images with diverse text prompts. Additionally, it extends to (c) unseen human videos, demonstrating its adaptability to new content. Furthermore, it supports various poses and perspectives, from full-body shots (a) to close-up face shots (c).
where ~ M represents the complement of the masked area and SD(.) is the stable diffusion inpaint- ing model that modifies the region M in Im according to the prompt P. This loss function is the key to our method, as it ensures that the immunization noise disrupts the editing process by forcing the unmasked regions to be filled with Os. Note that for editing models that do not rely on masks, we exclude masks from the loss calculations.
To enable training, curate dataset of image, mask and prompt tuples, represented D {(I*, (I+, P Specifically, we collect 1000 images of individuals from the CCP (Yang et al., 2014) dataset and use the Segment Anything Model (SAM) (Kirillov al., 2023) generate masks corresponding to the foreground objects in these images. To ensure diverse text descriptions for the editing tasks, we utilize ChatGPT OpenAI (2024) (see Appendix A.1). At each training step, a sample is selected from the dataset and initially processed by the immunizer model f(:;0) to generate immunization noise <i which added to the masked region of the training image and then clamped. The resulting immunized image I is then passed through the editing model SD) to produce the edited immunized image edm. The final loss function, L a Cnoise + Lodit is used for backpropagation with respect to the immunizer model's parameters. Backpropagating through the stable diffusion stages allows the immunizer to leam the interaction between the perturbation and the generated pixels. Through this iterative process, the immunizer model learns to generate perturbations that disrupt the editing model. Following the insights from PhotoGuard's encoder attack, we do not condition the immunizer model on text prompts, as the noise is empirically shown to be agnopt-agoostic (see Appendix A.6).
Inference During inference, the trained immunizer model generates immunization noise for any original (target) image using the mask of the region intended for protection. This noise is then applied to create the immunized image, with the noise restricted to the masked region. The resulting immunized image can be safely shared publicly. When malicious user inputs this immunized image along with an editing mask into a diffusion-basse editing tool (the same tool used during training), the immunization noise disrupts the edited output (see Fig. 3 (b)). Unlike previous approaches that require the same mask to be used during both training and inference, our method decouples these phases. This separation allows the immunizer model to generalize to unseen content, addressing the limitation of previous methods where malicious users could exploit different masks during editing (e.g. using an immunization mask of full-body but applying an editing mask of face).

---

Published as a conference paper at ICLR 2026
4 EXPERIMENTATION
Baselines We compare DiffVax with several existing image immunization methods. As a naive baseline, we include Random Noise, which applies arbitrary noise to images. We also evaluate two variants of PhotoGuard (Salman et al., 2023): PhotoGuard-E, which embeds adversarial per- turbations the latent encoder, and PhotoGuard-D, which disrupts the entire generative process. Additionally, we compare against DiflusionCuard (Choi et al., 2025), an extension of PhotoGuard that augments masks during optimization. To evaluate robustness against counter-attacks we de- velop three additional baselines where editing is applied after immunization: (i) passing the im- age through a convolutional neural network (CNN)-based denoiser (Li et al., 2023a), denoted as fVax w/ D.; (ii) compressing the image as JPEG (Sandoval-Segura et al., 2023) with a 0.75 compression ratio, denoted as D ffVax w/ JPEG; and (iii) applying the IMPRESS defense (Cao al., 2023), denoted as DiffVax w/ IMPRESS.
Evaluation metrics and dataset We focus on four key aspeets in evaluation: (a) the amount of editing failure, where we follow previous approaches (Salman et al., 2023) and utilize SSIM (Wang et al., 2004), PSNR and FSIM (Zhang et al., 201 1) metrics to measure the visual differences between the edited immunized image and the edited original image; (b) imperceptibility, where the amount of the immunization noise quantified by measuring the SSIM between the original image and the immunized image, denoted as SSIM (Noise); (c) the degree of textual misalignment evaluated using CLIP (Radford et al., 2021) by measuring the average similarity between the edited immunized image and the text prompt, denoted as CLIP-T; and (d) scalability by reporting the average runtime and GPU memory required to immunize a single image on average from the dataset. We curate a dataset of 875 human images from the CCP (Yang et al., 2014) dataset. Of these, 800 images are used for training (including the 75 seen images in our experiments), and 75 unseen images are reserved for testing.
Qualitative results Figures| 1 and 4 illustrate the qualitative success of our method. DifÉVax effectively immunizes images against various editing techniques, including standard inpainting and instruction-based models like InstructPix2Pix (Brooks et al., 2023) (Figure 1). As further detailed in Appendix A.2, the model demonstrates a strong ability to generalize to unseen images and a wide range of prompts, accommodating various human perspectives from full-body to close-up shots (Figure 4). Although trained primarily on human subjects, our model also extends its robustness to non-human objects. When compared to bascline methods (Figure 5), approach is qualitatively superior on both seen and unseen images, generating backgrounds that deviate more significantly from the intended edits. Notably, in many cases with our approach, it is impossible to infer the original prompt from the immunized image's background, a stark contrast to PhotoGuard, which often retains discernible hints of the prompt. More examples, including comparisons and results with other editing models, are provided in Appendix A.2.
DiffVax is more effective in corrupting edits est SSIM, PSNR, and FSIM values overall, securing second place in the SSIM metric for unseen data, with small margin behind PG-D, indicating that malicious edits on immunized images significantly distorted, even on previously unseen data, whereas baseline methods, which require optimization to be re-run for each image, do not differentiate between seen and unseen data. Ad- ditionally, CLIP-T results, which measure textual misalignment, further verify these findings by measuring the misalignment semantically in the edited immunized images. Di EVax outperforms the baselines by maintaining the highest SSIM (Noise) values for both seen and unseen data, high- lighting its effectiveness in corrupting malicious edits while keeping the immunized image imper- ceptible. This superior imperceptibilityy is achieved because our model learns to generate visually subtle, low-frequency perturbations, contrast to the scattered, high-frequency noise produced by prior methods (see Appendix A.5 for detailed discussion). Thus, training an immunizer model en- ables it to learn how to strategically place immunization noise to effectively disrupt diffusion- based editing, by aggregating over the training set. In contrast, prior optimization-base works only see single target image at a time.
As shown in Table 1, Di DiffVax achieves the low-
DiffVax is more scalable In addition to its strong qualitative performance, DiffVax offers sig- nificant advantages in speed and memory efficiency. It completes the immunization process in just 0.07 seconds per image average, compared to 207.0 seconds for PhotoGuard-E. 91 1.6 seconds for PhotoGuard-D. D, and 131.1 seconds for DiffusionGuard. In terms of GPU memory usage, DiffVax requires only 5,648 MiB, much lower than PhotoGuard-E (9,548 MiB), PhotoGuard-D (15,114
7

---

Published as a conference paper at ICLR 2026
Random Noisc Edited Image
PhotoGuard-D PhatoGuard-E
DifTusionGurrd
DiffVax (Ours)
Original Image
Edited Image
Edited Image
Edited Image
Edited Image
Edited Image
(e) Seen Images
'standing in warehouse with lot of shelves'
"in construction site"
(b) Unseen Images
"warking out gymnasium
Figure 5: Qualitative comparison of edited images across immunization methods. This figure shows the results of different immunization methods: Random Noise, PhotoGuard-E, PhotoGuard- D. DiffusionGuard, and our proposed method, Di DiffVax. Results for (a) seen and (b) unseen images are shown, with different prompts applied to each (right side). The first column contains the origi- nal images, while subsequent columns show the edited outputs under different settings, as depicted on the top. Note that Di fVax is substantially more effective than PhotoGuard-E, -D and Diffu- sionGuard in degrading the edit.
Table 1: Performance comparisons on images. The SSIM, PSNR, FSIM. SSIM (Noise). and CLIP-T metrics are reported separately for the seen and unseen splits of the test dataset. Runtime and GPU requirements are measured the average time (in scconds) and memory usage (in MiB) needed to immunize single image. "N/A" indicates that the corresponding value is unavailable. The symbols f and & indicate the direction toward better performance for each metric, respectively. Bold values indicate the best scores, while underlined values denote the second-best scores.
Amount of Editing
Imspereppibility
Text Misaligument
Scalabillty
Immunization Method
SSIM
PSNR J
(Noisc)
CLIP-T 1
Runtinie (5)
Reg.
Amm
utzeem
sem
s0mm
unseen
sem
(Immunizatio)
(Immunization)
Random Norse
0.586
0.585
16.09
16.40
0.460
0.458
0.902
0.503
31.68
31,82
NIA
NIA
PhotoGiand-E E
0.35M
0.365
15:29
15.63
0.413
0.408
0.966
01956
31.69
30.88
207.00
9,548
PhonoChand-I)
0.531
0.523
14.70
14.92
0. 888
0. 1.779
0.978
0.972
20.61
79.27
911 60
15,114
DiflusimnGuard
0.551
0.556
14.32
14.71
0.389
0.386
0.965
0.966
26.98
22,10
131.10
6.250
EiseVax (Ours)
0.510
0.326
13.96
14.33
0.353
0.362
0.989
0.989
23.13
24.17
0.07
5,418
MiB), and DiffusionGuard (6,750 MiB). This makes DiffVax a practical and scalable solution
for large-scale applications.
DiffVax is more robust to counter-attacks Table 2 shows that DiffVax is robust to common counter-attacks, including CNN-based denoising, JPEG compression, and IMPRESS (Cao et al., 2023). Di ffVax consistently outperforms PhotoGuard-D across all scenarios, as further evidenced by the detailed results in Appendix A.3.3. This robustness arises from Di ffVxx's ability to learn spatially targeted, low-frequency perturbations. Unlike existing approaches that produce more uni- form, high-frequency noise, our method's perturbations are less susceptible to removal by techniques like JPEG compression, which discards fegghfrry content, or by denoisers trained to suppress uniform noise. Crucially, as shown in Appendix A.3.2, DiffVax achieves superior edit disruption with much smaller mean magnitude of noise than baselines with larger fixed budgets. This high- lights that its strength lies in the strategic placement of noise, not simply its magnitude, supporting efficient and targeted noise distribution. Furthermore,
claim that DiffVax learns extensive robustness evaluations in Appendix A.3 show that DiffVax also maintains its effective- ness against attackers who vary their inference-time settings, consistently outperforming baselines across different sampling steps and diffusion samplers.
User study results We also conduct a user study with 67 participants on Prolific (2024), in which participants compare the "unrealisticness" level of baselines, and the edited image across 20 ran- domly selected image pairs, including both seen and unseen samples. For each model, we report the average rank, with our model achieving the top position with an average rank of 1.64, demonstrating clear superiority (see Appendix A.3.5), followed by PhotoGuard-D with a rank of 2.63.
8

---

Published as a conference paper at ICLR 2026
Table 2: Performance comparisons on edits with counter-attacks. We report the SSIM, SSIM (Noisc) and CLIP-T metries for the denoiser (D.), JPEG (compression ratio of 0.75) counter-attacks separately for the seen and unseen splits of the test dataset.
Method
SSIM 4
PSNR
FSIM L
SSIM (Noise) f
CLIP-T
snssen
PG-D w/
0.702
0.709
18.27
18.43
0.528
0.528
0.966
0.965
31.48
31.20
DiffusionGuard w/ D.
0,708
0.719
18.26
18.69
0.530
0.531
0.964
0.964
31.08
30.99
DiffVax
0.552
0.565
14.48
14.91
0.388
0.392
0.960
0.960
27.32
27.74
PG-D w/ JPEG
0.664
0.674
17.32
17.68
0.495
0.501
0.956
0.956
32.15
32:48
DiffusionGuard w/ JPEG
0,680
0.684
17:45
17.83
0.505
0.503
0.951
0.951
31.52
31.53
B1 Fvax w/ JPEG
0.522
0.538
14.17
14.61
0.374
0.382
0.959
0.959
26.04
26.05
PG-D w/ IMPRESS
0.578
0.563
15.89
16.07
0.436
0.426
0.640
0.634
31.35
31.26
DiffusionGuard IMPRESS
0.604
0.595
15.89
16.09
0.453
0,442
0.636
0.630
30.88
30.50
DiffVax w/ IMPRESS
0,488
0.500
14,04
14.38
0,355
0.359
0.644
0.637
24.88
25.27
Table 3: Ablation study. We report the SSIM and SSIM (Noise) metrics for cach loss term ablation, with
results presented individually for the seen and unseen splits of the dataset.
Method
SSIM $
PSNR
FSIM L
SSIM (Noise) f
CLIP-T +
s
M
5
"
DiffVax w/o Laaise
0.508
0.520
13.57
13.82
0.335
0.344
0.785
0.786
24.34
25.78
fiffvax w/o fodit
0.944
0.932
31.36
31.05
0.821
0.806
0.999
0.999
32.01
32.27
Diffvax
0.510
0.526
13.96
14.32
0.353
0.362
0.989
0.989
23.13
24.17
Ablation study To assess the contribution of each component in our framework, we conduct an ablation study by individually removing Ledit and Lnoise- As shown in Table 3, when Lnoise is re- moved, the model achieves slightly better performance on unseen data in terms of failed immunized editing (measured by SSIM. PSNR, FSIM and CLIP-T). However, the immunization noise is no longer imperceptible, as indicated by the change in the SSIM (Noise) metric. Conversely, when Cedit is removed, the SSIM (Noise) metric reaches its highest value, indicating minimal noise, but the model fails to prevent malicious editing, as reflected in the SSIM, PSNR, FSIM and CL.IP-T' met- rics. Thus, combining both terms in the final loss function is crucial for balancing imperceptibility and robustness in the training process (see Appendix A.7).
CONCLUSION AND DISCUSSION
Discussion on generalization While universal immunizer remains an open challenge, DiffVax demonstrates superior generalization over prior optimization-base work across three key dimen- sions. First, it addresses generalization to unseen models. Universal cross-model transferability is a difficult open problem, and like prior work, DiffVax is primarily model-specific and does not perfectly generalize to all unseen models. However, as detailed in Appendix 1.4.1, it demonstrates significantly better performance in the challenging black-box transfer task from a model trained on Stable Diffusion (SD) v1.5 to unseen SD v2 model. In this scenario, our learned immunization methods like PhotoGuard
successfully transfers its protective effect, whereas optimization- and DiffusionGuard fail completely, showing clear improvement in cross-moot cooss-moee robustness. Sec- ond, its feed-forward nature enables generalization to unseen content, significant advantage over methods requiring costly per-image optimization. As discussed in Appendix A.4.2, the success of Di DiffVax proves that the set of effective perturbations has learnable structure, allowing it to im- munize new images, prompts, and even videos with a single pass. Finally, DifEVax is uniquely robust in its generalization to unseen masks. Unlike prior work, it does not overfit to the train- ing mask's s shape or scale, maintaining its edit-disrupting effectiveness even when test-time editing masks differ significantly from the immunization mask, as shown in Appendix A.4.3.
Discussion on applications To further validate the versatility of DiffVax, we evaluate its effec- tiveness across a broad spectrum of real-world editing scenarios, as illustrated in Figure 6. Our experiments demonstrate robust protection against diverse manipulation types, ranging from global transformations such as artistic style transfer (e.g.. converting an image Cubism) to localized edits like facial expression changes and object attribute modification. Furthermore, the framework proves effective in complex settings involving multiple object editing, object replacement, and tex-

---

Published as a conference paper at ICLR 2026
(A) Multiple Editngg
(B) Facial Expression Change
(C) Object Replacement/
DidVaa
DiatVax (Durs)
Did (Oun)
Original Image
Edited Image
imag
Original Image
Edited Image
Edited Image
Original Image
Edited Imuge
Image
peomge: "turn casa into starues"
"make them ungry"
prompt "car crusher?
(D) Object Texture Editing
(E) Style Editing/ Artisti Editing
(F) Object Attribute Editing
DiffVax (Oun)
DiffVax (Oum)
DeffVax (Oun)
Original Inagee
Ediual Image
Edited image
Original Imagee
Edived Emsage
Edited Image
Original Image
Image
Edized Image
prompe
prompe: "change the style cubism"
prompt: 'give her
Figure 6: ViffVax performance across diverse editing applications. Our method effectively immu- nizes images against various manipulation types, including (A) multiple object editing, (B) facial expression changes, (C) object replacement, (D) texture editing, (E) artistic style transfer, and (F) attribute editing.
ture alteration. This wide applicability confirms that Di f FVax does not merely memorize specific noise patterns for simple inpainting but Iearns to disrupt the underlying semantic guidance required for various high-level editing tasks.
Discussion on editing models Following prior work, our main evaluations are conducted using inpainting-bass editing methods. However, emphasize that framework is model-agnostic and can be applied to various editing tools. To demonstrate this, we include additional results using the instruction- based model InstructPix2PPxx (IP2P) (Brooks et al., 2023) (see Figure 10 in the Ap- pendix) and the training-free model MagicBrush (Zhang et al., 2023b) (see Table in the Appendix). We find that IP2P is particularly well-suited for complex localized editing tasks, such as back- ground modifications, stylistic changes, or edits outside sensitive regions, whereas inpainting-bass based approaches are more specialized for background editing tasks. Specifically, inpainting methods can introduce unintended alterations in sensitive areas like faces when the provided mask only partially covers the target region. This can conflict with the intent malicious user, whose goal often to preserve identity while making selective edits.
Conclusion In this work, we present ffVx,, an optimization-free image immunization frame- work that protects against diffusion- based editing. Central to our approach is trained "image im- munizer" model that generates imperceptible perturbations to disrupt the editing process. At infer- ence, DiffVax requires only single forward pass, enabling scalability to large-scale deployments. Leveraging this efficiency, we extend our framework to video, demonstrating promising results for the first time (see Appendix A.3.6). Moreover, Di E ffax is compatible with any diffusion based editing tool and demonstrates strong robustness against counter-attacks. Overall, it establishes a new benchmark for scalable, real-time, and effective content protection.
ACKNOWLEDGMENTS
We acknowledge partial support from the Health Care Engineering Systems Center (Grainger Col- lege of Engineering, UTUC).
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: A query-efficient black-box adversarial attack via random search. In Andrea Vedaldi, Horst Bischof, Thomas Brox, and Jan-Michael Frahm (eds.), Computer Vision ECCV 2020 16th European Conference, Glasgow, UK. August 23-28, 2020, Proceedings, Part XXIII, vol- ume 12368 of Lecture Notes in Computer Science, pp. 484-501. Springer, 2020. doi: 10.1007/ 378-3-030-58592. 29.. URL petps://doit http://oooooorgoooooooooo 10. 10010000//11 978 3 030- 58592-
29.
Shivangi Aneja, Lev Markhasin, and Matthias NieBner. TAFIM: targeted adversarial attacks against facial image manipulations. Shai Avidan, Gabriel J. Brostow, Moustapha Cissé, Gio- vanni Maria Farinella, and Tal Hassner (eds.), Computer Vision ECCV 2022 17th European Conference, Tel Aviv, Isruel, October 23-27, 2022, Proceedings, Purt XIV, volume 13674 of Lec- ture Notes in Computer Science, pp- 58-75. Springer, 2022. doi: 10. (0000/97--30011-19100 URL https:/ / / /oii...... org/ 10. 1007 9978-9788333 3- 031- 19189199819_--
Markus Appel and Fabian Prietzel. The detection of political deepfakes. Journal of Computer- Mediated Communicationn 27(4))2mac008, 07 2022. ISSN 1083-6101. doi: 10.1093/jeme/
zmac008. URL httph::///// doi tttp://o.....gg////
cmc/ zmac008.
Arpit Bansal, Hong-Min Chu, Avi Schwarzschild, Soumyadip Sengupta, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Universal guidance for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 843-852, 2023.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šmdićć Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion Attacks against Machine Learning at Test Time, pp. 387-402. Springer Berlin Heidelberg, 2013. ISBN 9783642387098.
doi: 10.1007/ 6-2-642--400 40994-094---
978-3-642-44994--31 25. RtLhttp:/// 25.
/ttt:::///..// http//xxx.ooo/ doi. wrw.oogg///.../... 1007/ 1ttp://d.......g/101100/////////
Eric Blancaflor, Joshua Ivan Garcia, Frances Denielle Magno, and Mark Joshua Vilar. Deepfake blackmailing on the rise: The burgeoning posterity of revenge pornography in the philippines. In Proceedings of the 2024 9th International Conference on Intelligent Information Technol- ogy, ICITT '24, pp. 295-301, New York, NY, USA, 2024. Association for Computing Machin- ery. ISBN 9798400716713, doi: 10.1145/3654522.655555 URL https: /toii/doo//a/ org/10. CC. 1145/365 3654548.
Tim Brooks, Aleksander Holynski, and Alexci A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18392-18402, 2023.
Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative ai. Advances in Neural Information Processing Systems, 36: 36:10657-10677, 2023.
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pp. 39-57. IEEE Computer Society, 2017. doi: 10. 20119. URL https: / doi.
0rg/10.1109/ 2017.45
Hila Chefer, Yuval Alaluf, Yael Vinker, Lior Wolf, and Daniel Cohen-Or. Attend-and-excite: Attention-basee semantic guidance for text-to-image diffusion models. ACM Transactions on Graphics (TOG), 42(4):1-10, 2023.
Ruoxi Chen, Haibo Jin, Yixin Liu, Jinyin Chen, Haohan Wang, and Lichao Sun. Editshield: Protecting unauthorized image editing by instruction-guidee guiiedd diffusion models. arXiv preprint arXiv:2311.12066 2023.
June Suk Choi, Kyungmin Lee, Jongheon Jeong, Saining Xie, Jinwoo Shin, and Kimin Lee. Diffu- sionguard: A robust defense against malicious diffusion-based image editing. In The Thirteenth International Conference on Learning Representations, 2025. URL https: /ttss/////pe..e..../ net/forum? 9090ff Ko

---

Published as a conference paper at ICLR 2026
Samantha Cole.
We truly fucked: Everyone is making ai-generated fake porn
now. https: http://///rrricleerrdt-------- -apprad-------------aaaaaa------ 2024-11-14.
pttptpss//ttpp/////////////s hwwpw/www/// vice.
2018. Accessed:
Guillaume
Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. Diffedit: Diffusion- based semantic image editing with mask guidance. In The Eleventh International Confer- ence on Learning Representations, 2023a. URL https:/ http:s/////eeeeiewww net forum?id= 31ge0p5o-MS
Guillaume Couairon, Jakob Verbeek, Holger Schwenk, and Matthieu Cord. Diffedit: Diffusion- based semantic image editing with mask guidance. In The Eleventh International Conference on Learning Representations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023b.
URL https: pesttps://ppenee wpwnreveeeeeeeeeeeeeeeeeeeeeeeee net/ forum? id= aarrmmmid-ll
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensem- ble of diverse parameter-free attacks. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event, volume 119 of Proceedings of Machine Learning Research, pp. 2206-2216. PMLR, 2020. URL http: htttt::/proccedinggs. mlr. wtl..press/vll v/11vv1111 hwte11//roeeeee croce20b. html.
Jess Davies and Sarah McDermott. Deepfaked: 'they put my face porn video'. https:
/ h/www.dd bbc. com nww./wwwwwkeee wkwps//uu662221111 2022. Accessed: 2024-11-14.
Rebecca A. Delfino. Deepfakes on trial: call to expand the trial judge's gatekeeping role to protect legal proceedings from technological fakery. SSRN Electronic Journal, 2022. URL https: // //appi.a0 www.etmcsncooolaatt......mmmm .aaaar.rrg//Coo http:/CoopSID:24500000
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In 2018 IEEE Conference on Computer Vision and Pottern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pp. 9185- 9193. Computer Vision Foundation / IEEE Computer Society, 2018. doi: 10.1109/CVPR. 2018.00957. URL
thecvf. com/ http://cnnettttr____eeee srrpr_2018/htiie html..
Borgg_Bostiing.AbberrraaaaLLttt
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.). 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http: htttt:://axxi.oooe
hatp/aixvvvv////////aa//aaaaavva wwt./org/aaaaa.aa abs 1412. 6572.
Zhongliang Guo, Chun Tong Lei, Lei Fang, Shuai Zhao, Yifei Qian, Jingyu Lin, Zeyu Wang. Cunjian Chen, Ognjen Arandjelović, and Chun Pong Lau. A grey-box attack against latent diffusion model-based image editing by posterior collapse. arXiv preprint arXiv:2408. 10901, 2024.
Haya R. Hasan and Khaled Salah. Combating deepfake videos using blockchain and smart con- tracts. IEEE Access, 7:41596-41606, 2019. URL
org/CorpusID: 88489143.
Jamie Hayes and George Danezis. Learning universal adversarial perturbations with generative models. In 20/8 IEEE Security and Privacy Workshops, SP Workshops 2018, San Francisco, CA, USA, May 24, 2018, pp. 43 49. IEEE Computer Society, 2018. doi: 10. 10.11000 10.1109/SP.2018.0000 00011..
URL wwtpttttp///c /oi. org/ /1/////.... 10..0.000 1109//PM 2018 00015.
Amir Hertz, Kfir Aberman, and Daniel Cohen-Or Or. Delta denoising score. In IEEE/CVF InterCatioonnnoo International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 2328-2337. IEEE, 2023a. doi: 10. (09/ICCV51070.2023...o
URL httph:tt///// http://.....r11...11111111
ICCV51070 0 2023. 00221.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-or. Prompt-to-prone image editing with cross-attention control. In The Eleventh International Con- ference on Learning Representations, 2023b. URL https: : /ppeneeview net forum?
xzkzeyb.
12

---

Published as a conference paper at ICLR 2026
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6833 2020.
Leehyun Choi Jean Mackenzie. Inside the deepfake porn crisis engulfing korean schools.
pettps:/wwe..rrchhte org wtwp///w////eeeooooeeeeee/eeeee/ news htwps//artiioleesppdpppps......e 2024.
/wwww//wwwww/. bbc.ccm//
Tero Karras, Miik Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in neural information processing systems, 05.26565-265777
2022.
Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion mod- els for robust image manipulation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pp. 2416-2425, IEEE, 2022. doi: 10. 10.1109/CVR5526888.. 2WW.C//PPP22882222000244444 URL https: /ooi www...rrg/aa 11t.//1..111/////11 11t.0111201////222...... 2022. 00246.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015. URL http: //aarxiv.rrg/aaee /1122 6980.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander Berg, Wan-Yen Lo, et Segment anything. Proceed- ings of the IEEE/CVF International Conference Computer Vision, pp. 4015 2023.
Xinfeng Li, Yuchen Yang, Jiangyi Deng, Chen Yan. Yanjiao Chen, Xiaoyu Ji, and Wenyuan Xu. SafeGen: Mitigating Sexually Explicit Content Generation in Text-to-Image Models. Proceed- ings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS), 2024.
Yawei Li, Yulun Zhang, Luc Van Gool, Radu Timofte, al. Ntie 2023 challenge on image denois- ing: Methods and results. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2023a.
Yuheng Li, Haotian Liu, Qingyang Wu, Fangzhou Mu, Jianwei Yang, Jianfeng Gao, Chunyuan Li. and Yong Jae Lee. Gligen: Open-set grounded text-to-image generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22511-22521, 2023b.
Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion mod- cls. arXiv preprint arXiv:2305.12683 2023.
Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Machine Learning, pp. 20763-20786. PMLR, 2023.
Yuanze Lin, Yi-Wen Chen, Yi-Hsuan Tsai, Lu Jiang, and Ming-Hsuan Yang. Text-driven im- age editing via learnable regions. In IEEF/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024, pp. 7059-7068. IEFE, 2024. doi: 10. 1Lw.////PP273..2222...00 2024. 00674.
/10 URL httth:t//// /tt.
Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models manifolds. In International Conference on Learning Representations.
Ling Lo, Cheng Yu Yeo, Hong-Hap Han Shuai, and Wen-Huang Cheng. Distraction is all you need: Memory-effciient image immunization against diffusion-basse image editing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 24462 24471, June 2024.
13

---

Published as a conference paper at ICLR 2026
Andreas Lugmayr, Martin Danelljan, Andrés Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Inpainting using denoising diffusion probabilistic models. In IEEE/CVF Conference Computer Vision and Patter Recognition, CVPR 2022, New Orleans, LA. USA, June 18-24, 2022, pp. 11451-11461, IEEE, 2022. doi: 10.1 10.1109/CVRR52688. 202.22117.. URL https: //doi. 1 11tp:/...111////22222222
Repaint:
2022.00112
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018a. URL https: http:://ppppeeeeeeeeeee net/ Forum?id=rJzIBER
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada. April 30 May 3, 2018, Con- ference Track Proceedings. OpenReview.net, 2018b. URL https: wttpss//ppeeevee...e.. forum? Jz
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun- Yan Zhu, and Stefano Ermon. SDEdit: Guided image synthesis and editing with stochastic differential equations. In Interna- tional Conference on Learning Representations, 2022. URL https: httL.httt///pperrree//e //ppn/eevewwwe..e/////e/e net/
forum? dds.miidaaaasscPstt.
Daiki Miyake, Akihiro Iohara, Yu Saito, and Toshiyuki Tanaka. Negative- inversion: Fast image inversion for editing with text-guided diffusion models. arXiv preprint arXiv:2305. 16807, 2023.
Ron Mokady, Amir Hertz, Kfir Aberman, Yacl Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 6047. IEEE, 2023. doi: 10.1109/CVPRS222.. 2110299.22200088.. URL https: http:///..oo.oo...///ooo 1109/ CVPR52729 2023. 00585.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 2574-2582. IEEE Computer Society, 2016. doi: 10.1109/CVP.2206.2228 URL https: htt//oi..o.. org/10. 1109/ 2016 62282.
Scyed-Mohsen Proosavi-eezfolli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI, USA, July 21-26, 2017, pp. 86 94. IEEE Computer Society, 2017. doi: 10.1109/CVPR.2011..19 URL https:////// /ttp::///oiii /oi. org/ / 10. O. 1109 1110///CPPS 2017.17.
Chong Mou, Xintao Wang, Jiechong Song, Ying Shan, and Jian Zhang. Dragondiffusion: Enabling drag-style manipulation on diffusion models. In The Twelfth International Conference on Learn- ing Representations, ICLR 2024, Vienna, Austria, May 11, 2024. OpenReview.net, 2024a. URL / h wpw.review..eeeeeeeeeeeee.....w. net forumr (tt.//omdmo0ELA
Chong Mou, Xintao Wang, Lianghin Xie, Yanze Wu, Jian Zhang, Zhongang Qi, and Ying Shan. T2i-adapter: Learning adapters to dig out more controllable ability for text-to-image diffusion models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 4296-
4304, 2024b.
Amal Naitali, Mohammed Ridouani, Fatima Salahdine, and Naima Kaabouch. Deepfake attacks: Generation, detection, datasets, challenges, and research directions. Comput., 12:216, 2023, URL https://apl: www.nt htt.m//miic.cccl....oooooooooooo
wttg ID: 64478099.
OpenAl. Chatgpt. https::///// http:://hhaatttpppe com/, 2024. Accessed: 2024-10-02.
Gaurav Parmar, Krishna Kumar Singh, Richard Zhang, Yijun Li, Jingwan Lu, and Jun-Yan Zhu. Zero-shot image-to-image translation. In Erik Brunvand, Alla Sheffer, and Michael Wimmer (eds.), ACM SIGGRAPH 2023 Conference Proceedings, SIGGRAPH 2023, Los Angeles, CA, USA, August 6-10, 2023, pp. 11:1-11:11. ACM, 2023. doi: 10.1145/558833.3591533. URL https://don .og./oorgggoooe
35911113.
14

---

Published as a conference paper at ICLR 2026
Leandro A. Passos, Danilo Jodas, Kelton A. P. Costa, Luis A. Souza Júnior, Douglas Rodrigues, Javier Del Ser, David Camacho, and João Paulo Papa. A review of deep learning- based approaches for deepfake content detection. Expert Systems, 41(8), February 2024. ISSN 1468-0394. doi: 10.111 /exssy /ttll//xxx///11 13570. URL http:: /xx doi. org/ 0rgg10..111/EESS.. 13570.
Gan Pei, Jiangning Zhang, Menghan Hu, Zhenyu Zhang, Chengjie Wang, Yunsheng Wu, Guang- tao Zhai, Jian Yang. Chunhua Shen, and Dacheng Tao. Deepfake generation and detection: A
benchmark and survey, 2024. URL httph:t////ccmm /ttp///axvvvv/..///a//eeeeaaaav org/ abs/24033343 17881.
Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial pertur- bations. Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 4422 4431, 2018.
Prolific. Prolific:
Online participant recruitment for surveys and research. https:: com/, 2024. Accessed: 2024-11-01.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Ma- rina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Ma- chine Learning, ICML 2021, 18-24 July 2021, Viriual Event, volume 139 of Proceedings of Ma- chine Learning Research, pp. 8748-8763. PMLR, 2021. URL http:hhttpeeee SiRLattp://prcceedingg mlr. press gress/v139) radford2la. hammlmmlll...........
Hareesh Ravi, Sachin Kelkar, Midhun Harikumar, and Ajinkya Kale. Preditor: Text guided image editing with diffusion prior. arXiv preprint arXiv:2302.07979, 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer: High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Sarah Adel Bargal, and Stan Sclaroff. Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems. In Computer Vision-ECCV 2020 Workshops: Glasgow, UK, August 23-28, 2020, Proceedings, Part IV 16, pp. 236-251. Springer, 2020.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yacl Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 22500- 22510, 2023.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- tion processing systems, 35:36479-3644 36494, 2022.
Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious Al-powered image editing. In Andreas Krause, Emma Brunskili, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 29894-2999999 PMLR, 23-29 Jul 2023. URL https: htttt:::s///rooeeeigg..... mmlr. press/ /20ss/v202/2 sa malmammnnn.. html.
Pedro Landoval-Seguree Jonas Geiping, and Tom Goldstein. Jpeg compressed images can bypass protections against ai editing, arXiv preprint arXiv:2304.022344 2023.
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y. Zhao. Glaze: Protecting artists from style mimicry by Text-to-Image Image models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 2187-2204, Anaheim, CA, August 2023. USENIX As- sociation. ISBN 978-1-9331133-3--3. URL usen ixser
http://wwwwssniixiooo orreeiiixec///oooeeeeeeeee shan.
15

---

Published as a conference paper at ICLR 2026
Chun-Yer Shih, Li-Xuan Peng, Jia-Wei Liao, Ernie Chu, Cheng-Fu Chou, and Jun-Cheng Chen. Pixel is not a barrier: An effective evasion attack for pixel-domain diffusion models. arXiv preprint (xXv:22408.11800 2025.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learn- ing. pp. 2256-2265, PMLR, 2015.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http: //arxiv. aaaaaaaa1111 /1312. ...99..1.. 6199.
Zhizhong Wang, Lei Zhao, and Wei Xing. Stylediffusion: Controllable disentangled style transfer via diffusion models. In IEEE/CV International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pp. 7643-7655 IEEE, 2023. doi: 10. R.110//CCV555000.2222222 00706. URL https::p//.... doi org/10 1109 Ptt.///CC//110000 2023. 00706.
Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing. 13(4))600-61) 2004. doi: 00.1100/TP.2200.8118888
John Wojewidka. The deepfake threat face biometrics. Biometric Technology Today, 2020:5-7, 2020. URL https://///. /api. reeanticsccooll.
212281964
Chaowei Xiao, Bo Li, Jun- Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating ad- versarial examples with adversarial networks. In Jérôme Lang (ed.), Proceedings of the Twenty- Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018, July 13-19, 2018, Stockholm, Sweden, pp. 3905-3911. ijeai.org, 2018. doi: (0.2966/UUCA220188555 URL https: //tp:///oi...//.o org.or/g/.o........ooo.... wwg/olggg///o 10. 11t.4/////.a.2111111515
Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffusion-based mimicry through score distillation. In The Twelfth International Confer- ence on Learning Representations, 2024. URL https: http///pppe/eeeee////ee htt.://weeeet..ttte///eeemm forum?ide /
NZXCMe38HX.
Binxin Yang, Shuyang Gu, Bo Zhang, Ting Zhang, Xuejin Chen, Xiaoyan Sun, Dong Chen, and Fang Wen. Paint by example: Exemplar-base based image editing with diffusion models. IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pp. 18381-18 133811 IEEE, 2023. doi: 10. 10.1100 109 https: doi orgg 10. 1 109 /tt.9///2222222/00 2023 01763.
URL
Wei Yang, Ping Luo, and Liang Lin. Clothing co-parsing by joint image segmentation and labeling. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2014. Dataset available at https: ///www//wwwwww kaggle com/ /at httmm//aaattt//aaaaaaaaaa
Chin-Yuan Yuan Yeh, Hsi-Wen Chen, Hong-Han Shuai, De-Nian Yang, and Ming-Syan Chen. Attack as the best defense: Nullifying image-to-imat -mmage translation gans via limit-aware adversarial attack. In 2021 IEEE/CVF International Conference on Computer Vision, ICCV 2021. Montreal, QC, 16177. IEEE, 2021. doi: 10. 00110999944999222221... Canada, October 10-17, 2021, pp. 110. 11w.:..1111111/111121111 20211222222002222222 001...11111110 01588. 01588. URL https::////. /to./o......///..o www.oooorgg/....
Guanhua Zhang, Jiabao Ji, Yang Zhang, Mo Yu, Tommi S. Jaakkola, and Shiyu Chang. Towards coherent image inpainting using denoising diffusion implicit models. In Andreas Krause, Emma Brunskill, Kyunghyun Cho. Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (eds.), In- ternational Conference Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pp. 41164-41193 PMLR, 2023a. URL https: wtt.httt://proeeeeiiiiie /ttp///eeodnngs..////// ml ltt.ggs............... press/v202. prress//202/hhagg235333 /hagg2aann22 html.
16

---

Published as a conference paper at ICLR 2026
Kai Zhang, Lingbo Mo, Wenhu Chen, Huan Sun, and Yu Su. Magicbrush: A manually annotated dataset for instruction- guudddd image editing. Advances in Neural Information Processing Systems, 16:31428-3144 31449, 2023b.
Lin Zhang, Lei Zhang. Xuanqin Mou, and David Zhang. Fsim: A feature similarity index for image quality assessment. IEEE Transactions on Image Processing, 20(8):2378-2386, 2011, doi:
10.1109/TP2201.2119997.
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 3836-3847, 2023c.
Zongwei Zhou, Md Mahfuzur Rahman Siddiquee, Nima Tajbakhsh, and Jianming Liang. Unet++: A nested u-net architecture for medical image segmentation. Deep Learning Medical Image Analysis and Multimodal Learning for Clinical Decision Support : 4th International Workshop, DLMIA 2018, and 8th International Workshop, ML-CDS 2018, held in conjunction with MICCAI 2018, Granada, Spain, S..., 11045:3-11, 2018. URL https: / /api. semant icscholar.
sts//ooppuID::0783330
17


Reviews:
[{"review_id": "w2pzC1k3Kr", "reviewer": "Reviewer_zhhZ", "summary": "This paper proposes DiffVax, an optimization-free framework for image immunization against diffusion-based editing. DiffVax trains a feed-forward immunizer network that generates subtle perturbations to images in a single pass. The immunized images are able to resist various diffusion editing models, and the method is extended to the videos for the first time. Experiments demonstrate that DiffVax outperforms the selected baselines in terms of protective efficacy, visual imperceptibility, computational efficiency, and robustness to counter-attacks.", "questions": "1. How might DiffVax adapt or fail if diffusion editors adaptively employ adversarial training or adversarial purification to counteract immunization perturbations? Is it possible to provide a quick validation regarding its performance against DiffPure [2]?\n\n2. How would DiffVax perform on truly unseen diffusion architectures, especially non-LDM ones? The current generalization across editing models is only partially verified, i.e., from SD v1.5 to SD v2.\n\n3. Could the authors conduct additional ablations on the impact of norm selections for the loss terms?\n\n[2] *Diffusion Models for Adversarial Purification. in ICML 2022.*\n\nPlease respond to both the weaknesses and questions.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The improvement in scalability is significant, where a training time of around 22 hours exchanges to an inference-time reduction by several orders of magnitude, enabling the processing for videos.\n\n2. DiffVax presents commendable generalizability and applicability across both inpainting-based and instruction-guided diffusion editing models, flexible masking schemes, and unseen data.\n\n3. The qualitative and quantitative analyses supported by multiple complementary metrics and human ratings instantiate the thorough evaluation protocol.", "weaknesses": "1. Only two baselines are included for comparison. More relevant baselines are mentioned but not experimentally assessed. The claim that they 'are not directly applicable in our inpainting-based setup' is questionable, as at least SDS can handle under a SD inpainting setting.\n\n2. The application scenarios are limited to photographs featuring foreground objects or persons, where DiffVax prevents the background editing. Other use cases such as facial expression modification, artistic work protection, or anime secondary creation are not explored.\n\n3. The lack of failure case studies weakens the completeness of the manuscript. For example, the performance of DiffVax on data from other domains is unclear. Moreover, Fig. 14 shows that when the test-time mask size decreases, DiffVax fails as the bottom-right example.\n\n4. There is a minor issue that a highly pertinent work PCA [1] is omitted as related work.\n\n[1] *A Grey-box Attack against Latent Diffusion Model-based Image Editing by Posterior Collapse. arXiv preprint arXiv:2408.10901, 2024.*", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kHZE24uuqO", "reviewer": "Reviewer_ADC1", "summary": "1. The paper introduces DiffVax, a novel framework for immunizing images against diffusion-based editing. \n2. DiffVax proposes training a feed-forward immunizer model, which is based on UNet++, to generate an imperceptible perturbation in a single pass. \n3. DiffVax's main contribution is the optimization-free approach with a massive speedup from seconds to milliseconds, and claim the first application of such a defense to video content, which is enabled by low latency.\n4. Experiments demonstrate its effects compare with previous guard models.", "questions": "1. The paper demonstrates immunizing video frames to disrupt image edits applied frame-by-frame. Have the authors considered the effect of feeding a single immunized image into a dedicated image-to-video model such as SVD? It would be interesting to know if the perturbation also disrupts this different modality of generation.\n2. Following on the generalization weakness, how effective is this defense against more powerful, modern editing models like Qwen-Image, which are bigger and more robust? The evaluation on SD v1.5/v2 feels somewhat dated.\n3. Can the immunizer model be trained simultaneously against multiple distinct image-editing models to improve generalization?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The core idea of training a generative immunizer model instead of relying on per-image optimization is a significant and novel contribution.\n2. The primary strength is the practical, real-world benefits, which can reduce the immunization time from seconds to milliseconds and make video immunization feasible for the first time.\n3. The method demonstrates strong quantitative and qualitative results in disrupting edits from the specific models such as SD-Inpainting, InstructPix2Pix and MagicBrush. It also shows good robustness to standard counter-attacks like JPEG compression and denoising.", "weaknesses": "1. The method's real-world utility is limited by its reliance on an input mask $M$ for the protected region. In a practical scenario, this mask must be generated using model such as SAM, which is a non-trivial computational step. This added overhead is not accounted for in the \"milliseconds\" performance claim and creates a time-consuming bottleneck that limits the method's true end-to-end speed and ease of use.\n2. The immunizer model was trained on a very small 800 images dataset. This narrow data scope raises concerns about the model's ability to generalize. The results, which are almost entirely focused on people, are not sufficient to prove the method works on the vast diversity of in-the-wild content which may out-of-distribution.\n3. The paper states the immunizer model $f(\\cdot;\\theta)$ is a UNet++, but this architectural choice is not justified. Given this model is central to the paper's contribution, there is no discussion of why this specific architecture is required over other architectures. The design details and properties of the immunizer itself are underdeveloped.\n\nI will consider adjusting my score if my concern is well resolved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vy0LduvJBY", "reviewer": "Reviewer_yHZo", "summary": "The paper introduces DiffVax, an optimization-free framework for image immunization against diffusion-based editing. Instead of performing costly per-image optimization, DiffVax trains a lightweight immunizer network to generate imperceptible yet effective perturbations in a single forward pass. The resulting perturbations not only degrade edits produced by various diffusion-based models (e.g., inpainting, InstructPix2Pix) but also exhibit strong resilience to counter-attacks such as JPEG compression and denoising. Owing to its scalability and efficiency, DiffVax extends immunization beyond static images to video content.", "questions": "1. In Figure 14, only the third row corresponds to the case where the editing mask is identical to the one used during training. For the remaining rows (e.g., rows 1–2 where the perturbation is partially masked, and rows 4–5 where the edit mask includes unprotected regions), it is unclear whether the model still forces the edited region to degenerate into low-information content (e.g., pixel values = 0). Can the authors clarify whether the masks used in Figures 1, 4, and 5 are identical to the training-time immunization masks? Moreover, can the authors provide both qualitative and quantitative results—along with comparisons to baseline—for scenarios where the edit-time mask occludes only part of the perturbation or includes perturbation-free regions?\n2. Have the authors evaluated their method under alternative inpainting settings? Specifically:\n(1) How does DiffVax handle the case where the targeted region is masked and edited, such as in the foreground object replacement (e.g., from human to other object)?\n(2) Can the method generalize to multi-object scenes, where multiple semantically important regions may need protection simultaneously? Providing results for these broader cases would better validate the robustness and applicability of the proposed method.\n3. Have the authors considered including task-aligned baselines, such as AdvPaint [1] or other immunization approaches specifically tailored to inpainting models? A comparison with such baselines would provide a more comprehensive and fair evaluation of the method's effectiveness in its target domain.\n4. Can the authors clarify the actual GPU memory requirements during training, particularly when backpropagating through the denoising steps of the diffusion model? Given that the experiments were conducted using a single A100 GPU, how feasible is it for real-world image owners with limited hardware (e.g., <16 GB VRAM) to train or fine-tune such an immunizer model? A discussion on resource requirements and practical accessibility would strengthen the paper’s applicability claims.\n\n[1] Jeon et al., AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption, ICLR 25.", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The proposed method demonstrates robust protection even on previously unseen images, suggesting that the learned perturbation strategy generalizes beyond the training distribution.\n2. Unlike prior optimization-based approaches that are computationally prohibitive, DiffVax achieves real-time immunization via a feed-forward model. This efficiency allows the framework to extend immunization to video content, which is infeasible for existing methods.", "weaknesses": "1. While the proposed method introduces a training-time immunization mask to constrain the perturbation to semantically important regions, it remains unclear how robust the method is when malicious editing masks deviate from those used during training. Although the authors briefly mention this scenario (Lines 313–317), the model is trained using a single fixed mask per image, and no explicit mechanism is introduced to ensure robustness against arbitrary or partially overlapping test-time masks. This raises concerns about edit-time generalization in realistic attack settings.\n2. The experimental setup primarily focuses on single-object foreground inpainting tasks, where the perturbation is confined to a specific region (e.g., a human subject). This narrow scope limits the understanding of how well the method generalizes to more diverse and realistic editing scenarios, such as foreground object editing or multi-object scenes, which are common in real-world applications.\n3. The baseline selection in the experimental comparison may raise concerns about fairness. While the proposed method is evaluated primarily on inpainting-based diffusion models, the compared immunization baseline Photoguard were originally designed for broader image-to-image translation tasks, not inpainting. This mismatch in task formulation may bias the evaluation in favor of the proposed approach and limit the relevance of the reported comparisons.\n4. While the paper emphasizes the low memory footprint of DiffVax at inference time (5,648 MiB as stated in Line 413), the training phase appears significantly more demanding. Since the immunizer is trained using a loss computed on the edited output—requiring backpropagation through multiple steps of the diffusion process—it is unclear whether the overall method is truly more memory-efficient than optimization-based approaches like PhotoGuard, which reportedly require 15 GB. The paper does not provide concrete memory usage statistics for training, leaving the claimed efficiency somewhat unsubstantiated.\n\nNote: Weaknesses 1-4 correspond directly to Questions 1-4.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zO4dKrpwJY", "reviewer": "Reviewer_fZtv", "summary": "This paper introduces DiffVax, a diffusion-based image immunization framework designed to prevent unauthorized editing by generative diffusion models. The method learns an optimization-free, feed-forward perturbation generator that produces subtle but effective protective noise, achieving strong robustness and generalization across different editing models and mask settings.", "questions": "- Could the authors provide a more detailed description of how the SD($\\cdot$) operator in Section 3.3 is computed? Does it require running the full diffusion reverse process, and if so, would that be computationally expensive? How do the authors ensure stable gradient propagation through such a process?\n- Can the proposed protection method be fine-tuned with a small number of samples to neutralize its effect?\n- Could the authors include learning curves for each loss component during training to better illustrate the convergence behavior?\n- The authors could consider incorporating the references mentioned in the Weaknesses section into the Related Work to provide a more comprehensive contextual discussion.\n- It would be helpful if the authors could expand the Appendix to discuss the method’s limitations and summarize the potential future directions mentioned across different sections.\n\nI encourage the authors to strengthen the paper by addressing these points in the rebuttal.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- The authors propose DiffVax, a diffusion-based immunization framework that protects images from unauthorized edits through an optimization-free, feed-forward process generating imperceptible yet effective perturbations.\n- The method demonstrates superior robustness, efficiency, and generalization to unseen models, content, and masks compared to prior optimization-based defenses.\n- This paper demonstrate consistent empirical improvements over baseline optimization approaches in both efficiency and performance.\n- The experimental discussion is thorough, with complete ablation studies and detailed analyses.\n- This paper include a user study to further strengthen their results.", "weaknesses": "- The paper presents an empirical approach with limited theoretical justification, relying mainly on experimental evidence rather than principled analysis.\n- The experiments are comprehensive and the discussion is rich and detailed, with no critical methodological flaws identified.\n\n### Suggestions\nIt would strengthen the paper to include recent diffusion-based image protection works, such as the attention-guided EditShield [1] and the latent-space diffusion attack [2], which also explore strategies for preventing unauthorized image editing.\n \n[1] Chen et. al. EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models, ECCV 2024  \n[2] Shih et. al. Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models, AAAI 2025", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)