IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based  Generative AI
Authors: Bochuan Cao
Changjiang Li
Ting Wang
Jinyuan Jia
Bo Li
Jinghui Chen
Venue: NeurIPS 2023 poster (2023)
Keywords: Image Generation Godels
Latent Diffusion Models
Image Purifying
TL;DR: We devise a new optimization strategy for purifying the image and disabling the added protective noise against the image generation system

Abstract: Diffusion-based image generation models,  such as Stable Diffusion or DALL·E 2, are able to learn from given images and generate high-quality samples following the guidance from prompts. For instance, they can be used to create artistic images that mimic the style of an artist based on his/her original artworks or to maliciously edit the original images for fake content. However, such ability also brings serious ethical issues without proper authorization from the owner of the original images. In response, several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations, which are designed to mislead the diffusion model and make it unable to properly generate new samples. In this work, we introduce a perturbation purification platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure.
IMPRESS is based on the key observation that imperceptible perturbations could lead to a perceptible inconsistency between the original image and the diffusion-reconstructed image, which can be used to devise a new optimization strategy for purifying the image, which may weaken the protection of the original image from unauthorized data usage (e.g., style mimicking, malicious editing).
The proposed IMPRESS platform offers a comprehensive evaluation of several contemporary protection methods, and can be used as an evaluation platform for future protection methods.

IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Basee Generative AI
Bochuan Cao
Changjiang Li Stony Brook University reet.cjim gmaal.mmmlllooo..m com
The Pennsylvania State University
bccaoêpsu.edu
Ting Wang
Jinyuan Jia The Pennsylvania State University jinyuan@psu. eduu eduu
Stony Brook University inbox. aeaingggmmainnn com
Bo Li
Jinghui Chen
University of Illinois, Urbana Champaign
The Pennsylvania State University jzc59178psu. edu
Abstract
Diffusion-basee image generation models, such as Stable Diffusion or DALL-E 2, are able learn from given images and generate high-quality samples following the guidance from prompts. For instance, they can be used to create artistic images that mimic the style of an artist based his/her original artworks or to maliciously edit the original images for fake content. However, such ability also brings serious ethical issues without proper authorization from the owner of the original images. In response, several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations, which are designed to mislead the diffusion model and make it unable to properly generate new samples. In this work, we introduce perturbation purification platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure. IMPRESS based on the key observation that imperceptible perturbations could lead to perceptible inconsistency between the original image and the diffusion- reconstructed image, which can be used devise new optimization strategy for purifying the image, which may weaken the protection of the original image from unauthorized data usage (e-g., style mimicking, malicious editing). The proposed IMPRESS platform offers a comprehensive evaluation of several contemporary protection methods, and can be used as an evaluation platform for future protection methods.
Introduction
Diffusion-bar image generation models, e.g., Stable Diffusion (Rombach et al. (022h) and DALL-- E 2 (Ramesh et al. (022), have gained increasing attention due to their exceptional performance in synthesizing high-quality samples by leveraging given images. Despite their superior performance, existing studies (Shan et al. 2023) showed that they could be abused to generate new images without proper authorization from the original data owner. For instance, they could be used learn from the original artworks of a specific artist and generate artistic images that mimic his/her style without authorization, which may lead to violation of intellectual property or copyrights (Dixit) (203) Joseph
Saveri Law Firm LLP 2023
Edwards 2022). They can also be used to maliciously edit the images
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Task:
Style Mimicking, Aim Artist: Claude Monet
Image Editing, Prompt: "A person in an airplane"
Source:
Clean Image
Protected Image
Purified Image
Clean Image
Protected Image
Purified Image
Samplel:
Sample2:
Figure I: Examples of imperceptible perturbations that are less effective in preventing unauthorized data usage after being purified by IMPRESS, Left: Stable diffusion generated images mimicking the style of Claude Monet using clean images, GLAZE (Shan et al. (023) protected images, and IMPRESS purified images for model fine-tuning. Right: images edited by Stable diffusion using the prompt "A person in airplane" with clean images, PhotoGuard (Salman 2023) protected images, and IMPRESS purified images model input.
of celebrities downloaded from the Internet to create disinformation (Pranav Dixit 2023 Li et al. 2022a Those unauthorized data usage without the consent from the original data owner creates severe ethical concerns and causes profound societal harm (Shan et al. 2023).
To prevent unauthorized data usage, some recent studies (Shan et al. [023 Salman et al. 2023 pro-
posed to add imperceptible perturbations to images such that the latent diffusion model (LDM) (Rom-
bach et al. 2022b), state-of-the-arr diffusion-based image generation model, is not able to leverage perturbed images to generate high-quality samples. For instance, PhotoGuard (Salman et al. 2023) proposed to add imperceptible perturbations to the images such that LDMs cannot generate realistic images when attempting to edit upon the perturbed image. GLAZE (Shan et al., (023) proposed to add imperceptible perturbations to the artworks of artist such that the LDMs cannot learn from perturbed images to generate samples that mimic the style of the artist. These works share a common trait: they all aim to add imperceptible perturbations the original images to protect them from being "ccorrecll"" processed by the LDMs without proper authorization.
Although those protection methods (Shan et al. 2023: Salman et al. (023)) show some promising demos on preventing unauthorized data usage, we still lack a systematic understanding of their robustness and practical performances. For instance, since the perturbations added by those methods are imperceptible, we could potentially purify a perturbed image to disable its perturbation.
In this work, we aim to bridge the gap by conducting a systematic examination of those protection methods. We argue that this examination essential from two aspects. First, the effectiveness of those protection methods under strong, adaptive perturbation purification is unknown. As result, the examination could help users obtain a better understanding on the effectiveness of those protection methods in different scenarios. Second, the examination could also shed light on the design of new protection methods. The developed system can also be used as an evaluation platform for testing the effectiveness of future protection methods.
Our key observation is that the current "successful" imperceptible perturbations usually lead to perceptible inconsistency between the original image and the diffuusion-reconsttuutee image (i.e., the image-to-ime to-image output of the LDM without given any prompt), which can be used to devise a new optimization strategy for purifying the image and disabling the added perturbation. Specifically, we derive two conditions that the purified image should satisfy: similarity condition and consistency condition. The similarity condition suggests that the purified image should be visually close to the perturbed image, and thus visually close to the original image (since the perturbation is imperceptible). The consistency condition means that the reconstructed image by a LDM for the purified image should be similar to itself. This condition stems from the observations that the clean image can reconstruct the original image and satisfy such consistency condition while the perturbed image cannot. We defer the detailed derivation of those two conditions to Section 4 Given those two conditions, respectively design two losses to quantify them, enabling us to formulate the purification of

---

perturbed image an optimization problem. Finally, we solve the optimization problem and obtain the purified image. In summary, our contributions are as follows:
We have explored and analyzed existing protection methods for unauthorized data usage in diffusion models and pointed out the potential risks. We found that existing methods heavily rely on adding imperceptible perturbation. Yet such an imperceptible perturbation usually leads to a perceptible inconsistency between the original image and the diffussion-reconstuucteed image.
Based on the empirical findings, we propose IMPRESS, i.e., IMperceptible Perturbation REmoval SyStem, new platform for evaluating the effectiveness of imperceptible perturbations protective measure by purifying a perturbed image with consistency- -based losses.
We also test the effectiveness of adaptive protection designs which also feature our consistency- based loss upon those existing protection methods. We find that it is difficult generate effective imperceptible perturbations through such a simple adaptive design, highlighting the need for more advanced methods to prevent unauthorized data usage in LDMs.
2 Related Works
Diffusion- based Image Generation Systems. Recently, Diffusion Probabilistic Models (DPMs)
(Ho et a 2020) have achieved impressive results in the field of image generation (Croitoru et al.
2023), inc Inciiin applications such as unconditional image generation(Ho et al. 2020]Nichoo Nichol and
Dhariwal 2021 [Song et al. (202aa), text-to- text-to-image synthes (Shi et al., [022 Rombach et al.) 2022a
Saharia et al. 2022b), image-to-image translation (Wolleb et al. al.| 2022 | Li et al.. 2022b Wang et al.
Zhao Zhao et al. 2022, Saharia et al., 2022a), image editing (Avrahami et al. [0222] Meng et al.
2021), and image impaintin((_ugman
et al. [022] [ugeau and Bertalmio 2009). DPMs typically employ U-Net (Ronneberger et al. 2015) architecture as the underlying neural backbone, which
naturally adapts to image- like data (Dhariwal and Nichol, 2021 Ho et al. 2020 Song et al. 2020b
Ronneberger et al., (015).
Latent Diffusion Models. In image generation tasks, training and evaluating DPMs the original image feature space can lead to low inference speed and high training costs. Recent works have been trying address this issue by using advanced sampling strategies (Song et al., 2020a Kong and Ping |021 Roman et al., (021). hierarchical approaches (Ho et al. 2022, Vahdat et al. 2021). and feature compression strategy (Rombach et al., 2022b). Among them, latent diffusion model (Rombach et al.) 2022b) employs a pre-trained image encoder and decoder, enabling the DPM to work in compressed, low-dimensional latent space, thus reducing the computational cost of training and accelerating inference speed while maintaining almost the same quality of synthesized images.
Unauthorized Data Usage in Diff'usion Models. The powerful image generation and editing capabilities of Al have also raised ethical concerns, including malicious image editing (Goodfellow
al. 2014 Mirza and Osindero 2014, [Salimans et al.) 2016 Isola al. 2017| Zhu et al. 2017
Zhang et al.
2017; Karras et al.
2018 Brock et al.] 22199] Karras et al. 2019 Rombach et al. 2022b
Ramesh et al.) 2022) or training image generation models using unauthorized images from artists and
mimicking their styles (Shan et al. 2023). Some works have attempted to address this issue, such as
removing certain knowledge from models (Gandikota et al., 2023) or making images unlearnable
or uneditable (Huang et al. 2021 Fu et al. [201] et al.
2023 Salman et al. (023). However,
other studies argue that such imperceptible perturbations are fragile (Radiya-Dixit et al. 2021b).
3 Preliminaries
We briefly introduce the preliminaries on Latent Diffusion Models (Rombach et al. 2022b and existing protection methods (Salman et al. 2023 Shan et al. 2023).
Latent Diffusion Models (LDMs). Latent diffusion model (Rombach al. 2022b) aims to train the diffusion model on diver-dimensionll latent space to generate high-quality samples while saving computation costs. Moreover, can utilize additional information, such as text, to guide the generation process, enabling it to generate or edit images with guidance from prompt (e.g., text). Given an image x, LDM first uses an image encoder to embed it into a latent representation, i.e., z = E(x) and then perform 7 forward diffusion steps by progressively adding Gaussian noise NO I), to the latent space. For simplicity, we use Zi, 22, ... ZT to denote latent representations at each forward diffusion step. Suppose have prompt y (c.g., a certain text phrase), feature extractor 7
3

---

and we denote the embedding of y ra(y). The goal of the LDM is to train conditional denoising network Eo. e.g.. UNet (Ronneberger et al., 2015), to model the conditional distribution p(zly) by gradually recovering from 2r based on To(y). Suppose 60(2,, L, To (y)) is the Gaussian noise estimated in the 1-th step. We can train 6g based on the following loss:
LLDM == EE(3),,.-~ ||e Es(2,, To (o)
(3.1)
Suppose ž is the latent representation obtained after T denoising steps. We can image decoder DD to obtain the generated image x based on Z, i.e. X = D(z). For simplicity, we denote the end-to- end framework obtain X based x and y as x = fLDM (x: y). Given prompt, LDMs can be used to generate a sample or edit an image. Note that when there is no prompt y, the LDM reconstructs its input image x, i.e., would be very similar [x.DM()).
PhotoGuard. PhotoGuard (Salman et al. 2023) proposes to add carefully crafted perturbations to an image before making it publicly available (e.g.. uploading it to the Internet) raise the cost of malicious image editing. When using LDMs to edit the perturbed images, the output is usually less realistic. Specifically, PhotoGuard proposes two approaches: encoder attack and diffusion attack.
The goal of the encoder attack is to add a perturbation denc to an image x such that the image encoder E produces similar outputs for x + denc and a target image Xarget (e.g., a pure gray image random noise). Formally, dene can be obtained by solving the following optimization problem:
enc = argmin ||E(x + 5) - (Xaaga)) 1.
(3.2)
| | SA
where A is the Loo norm perturbation budget. The noise added to the image could be imperceptible to human eyes when A is small. Thus when LDMs are used to edit x + Sene. the resulting output would be similar to the target image instead. The diffusion attack, on the other hand, is more direct and aims to craft perturbation dat such that the output of the LDM is similar to Xurget
ô diff argmin [I + 6) Xtarger 1|2
(3.3)
Compared to the encoder attack which only targets the image encoder, the diffusion attack considers the whole LDM model with prompts, achieving better empirical performance but is less efficient.
GLAZE. GLAZE (Shan et al. 2023) aims to add perturbations the artworks of artist such that LDMs cannot learn the correct style of the artist from perturbed artworks. Given an image x, GLAZE first chooses target style T that is sufficiently different from the style of x. Then, GLAZE transfers x to the target style T using a pre-trained style transfer model Ω. For simplicity, we use Q(x, T') to denote the style-transfereed image. Given ((x, T). GLAZE crafts the perturbation òGLAZE by solving the following optimization problem:
SZLAZE min ||E(S((,, T)), + 1) + X max (LPIPS (x, (x,x+ 8) -),, à
(3.4)
where LPIPS (Learned Perceptual Image Patch Similarity) Zhang al. 2018) measures user- perceived image distortion, A is the perturbation budget, and Á is a hyper-parameter adjusting the strength of the LPIPS regularization term. Roughly speaking, GLAZE aims to perturb images (e.g.. artworks of an artist) such that a LDM generates samples with the target style instead of the original style when learning from the perturbed images.
4 Proposed Method
In this section, we formally study the potential vulnerabilities in existing protection methods and discuss our proposed method to disable perturbations added by those methods.
4.1
Analyzing Potential Vulnerabilities of Existing Methods
We notice that existing protection methods (e.g., PhotoGuard and GLAZE) all aim to add impercepti- ble perturbations such that LDMs cannot "correctly" learn or process the perturbed image for style mimicking or malicious editing. While such perturbations certainly raise the cost of unauthorized data usage, is not flawless. Specifically, one special use case of L.DM is to let it reconstruct the image, i... let an image run through the entire LDM (encoder, forward diffusion, backward diffusion,

---

Clean Image:
Protected Image:
SLOM
LDM
Consistent
Inconsistent!
Figure 2:
Examples of inconsistencies observed when using LDMs to reconstruct the protected images. Left: the cnffusiionrreconstuuctee clean image looks similar to the original image; Right: images protected by GLAZE (Shan et al. 2023 leads to noticeable inconsistency after reconstruction.
decoder) without any prompt. In such case, the output of the LDM (denoted by fLDM (x)) should be close to the original imput x. However, since the imperceptible perturbations are able to deceive the LDMss (to believe that the image is from another style or that the image's s latent embedding is close to a target image), its reconstruction result (Xpuh) may no longer be close to the perturbed input xpb. Rather, it could become similar to target image or target style instead.
Figure shows an example painting by Claude Monet and its protected version by GLAZE (hhan et al. 2023). When using LDMs to reconstruct the two images respectively, we can observe that the protected image leads to noticeable inconsistency after reconstruction while the clean image stays roughly the same. In other words, the reconstructed version of the perturbed image is no longer close itself, rather, it more close to the targeted style (e.g.. Cubism by Picasso). By contrast, a clean image and its reconstructed version do not have such inconsistency. This inspires us to leverage the inconsistency to purify the perturbed image disable such imperceptible perturbations.
4.2
Our Proposed Method
Based on our previous empirical findings, given perturbed image Xpbb created by existing protection methods via imperceptible perturbations, we aim to purify the perturbed image to disable its perturba- tion. We first derive the two conditions that the purified image Xpur should satisfy, then formulate IMPRESS, i.e., IMperceptible Perturbation REmoval SyStem, as an optimization problem based on those two conditions and provide our solution to solve it, and finally show our complete algorithm.
Two conditions for purified image. The purified image Xpur should satisfy two conditions: similarity condition and consistency condition. Next, we respectively derive them.
1. Similarity condition. Our ultimate goal is make sure the purified image Xpur stays visually close to the original image i.e., Xpur ss x. Recall that existing methods (Salman et al. 2023 Shan et al., 2023) aim to add imperceptible perturbation to a given image x to craft a perturbed image ppb (see Section for details). Therefore, the perturbed image Xptb is already close the original image x. Based on this observation, since we only have access to the perturbed image Xyth requiring the purified image Xpur to stay visually close to the perturbed image Xpth would be sufficient to guarantee Xpur R x. This leads to similarity condition.
2. Consistency condition. As our goal to find purified image Xpur close to the original image X. Xpur should share some similar traits as x. Our observation in Section 4.1 suggests that clean image can stay roughly the same after cefffusioonrcconstruutttoo while the perturbed image cannot. Therefore, to make Xpur close to x, we also require the purified image Xpur to be able to reconstruct itself using LDMs, i.e., Xpur R (Xpur) This leads consistency condition.
Formulating IMPRESS as an optimization problem. Our key idea is to define two losses that respectively quantify the similarity condition and consistency condition.
1. Quantifying similarity condition. Our similarity condition means that Xpur would be visually close to Xpth Following previous studies (Shan et al,, 2023), we use LPIPS (Learned Perceptual Image Patch Similarity) (Zhang et al. 2018) to quantity the visual difference between Xpur and Xpth- Formally, we have the loss max (LPIPS (xpuu: Xpt) Ar. 0), where A, is the perceptual perturbation budget. We note that LPIPS is widely adopted in various fields (Cherepanova et al.
5

---

similarity loss
(inaccosiibee)
Xptb
xpur
Input
#
consistency loss
D
After D(E())
Figure 3: A sketch our method consists of losses: the similarity loss and the consistency loss. The similarity loss requires the purified image Xpur to stay close to Xpab while the consistency loss requires the encoder/decoder reconstructed image stay close Xpur itself.
2021 Laidlaw et al., 2020 Rony et al. 2021) as provides measure human-perceitn
image distortion. Compared -oorm constraint, LPIPS offers more flexible constraint ranges. If the modified image still appears similar to the original image from a human perspective, allows for larger changes in certain parts of the image, which aligns with our goal of preserving as much semantic information from Xptb as possible.
2. Quantifying consistency condition. Our consistency condition implies that Xpur SLUM (Xprz) Intuitively, can define the consistency loss ||Xqur fLDDM (Xpur) 1... However, it is very challenging to directly optimize this loss as it involves the complicated diffusion process (i.e., gradually adding and removing Gaussian noise). To address the challenge, we simplify the loss by removing the diffusion process in it. In particular, we define the loss ||Xpar (xper) to quantify the consistency condition, where & and D are the image encoder and decoder the LDM. Note that ||xpur ((E((xur (xx((x):))ll can approximate ||Xpur fLOM (Xpur) _1 as the goal of reconstruct latent representation. Moreover,
the diffusion process (without any prompt) such approximation enables us to solve the optimization problem efficiently.
Combining the above losses together, our final optimization problem is follows:
min Xpur
D(E (xxxxxx) )11 + max MMax(LPIPS/ (xpuss Xpth) Ar, 0),
(4.1)
Xpc
consistency less
similarity loss
where a is hhper--pramene parameter to balance the two losses. Given a perturbed image Xpth the solution to the optimization problem in Eq. 1).1) the purified image Xpur- We use projected gradient descent to solve the optimization problem efficiently. In practice, we initialize Xpur by Xpth plus an extra small Gaussian perturbation similar in Madry al. (018). A summary of our proposed method is shown in Algorithm]] I in the Appendix.
Experiments
In this section, we conduct comprehensive experiments to demonstrate the effectiveness of the proposed method and verify its capability to disable imperceptible perturbations introduced by existing protection methods. Specifically, we evaluate against two protection methods on the specific tasks for which these methods were proposed: style minicking and malicious editing images.
5.1 Experimental Settings
Style Mimicking We conduct the style mimicking experiments on the WikiArt dataset (Saleh and Elgammal 2015). For GLAZE (Shan et al. 2023 essentially followed the settings of the
"Experiments reproduced based the 3rd version of the GLAZE paper Arxiv (11 Apr 2023).

---

original paper and reproduced the code: given a victim artist V, we randomly select 124 of their works. We use ViT+GPT2 model to generate title for each artwork and attach the victim artist V's name to the generated title our prompt y. Next, we randomly draw 24 works from these 124 art pieces as the style imitation training set, and the remaining 100 as the test set. We fine-tune a pre-trained LDM on the training set, and then generate new artworks mimicking the style of the victim artist by the prompt y,
Malicious Editing of Images For malicious editing of images, we utilize the code and settings made public by Photoguard (Salman et al. 2023). The purpose of malicious editing is to modify the background of photo following the given malicious prompt. We conduct our experiments on the Helen (Le et al. 2012) dataset for this task. We selected the 80 images with the smallest face-to-image ratio from the Helen dataset and their corresponding face masks. Subsequently, we use Photoguard to generate protective noise for these images. Then, we attempt to modify the images using a latent diffusion model. We generate noise using the most powerful Diffusion attack-1.2 method in Photoguard.
Baselines To show the effectivvness of IMPRESS is obtained through our consistency-based loss design, we also consider three other simple post-processie baselines: JPEG compression of the image, adding Gaussian noise to the image, and resizing the image. For JPEG compression, we set the quality factor as 15%. For adding Gaussian noise, we the mean as and the variance as 0.15. For the image resizing method, we first resize the 512 x 512 image to 256 x 256, then resize it back 512 512.
5.2 Experimental Results on Style Mimicking
Table I:
Comparison of style mimicking performances when using fine-tuning data from clean images, GLAZE-protected images and post-processed protected images by our method and baselines. A higher accuracy suggests that the generated image style is close to the artist be mimicked.
Post-processed
Metric
Clean
Protected
JPG
Noise
Resize
Ours
CLIP classifier Ace
90.8 + 3.2
42.5 + 8.3
64.9 + 7.6
47.9 + 7.0
66.6 + 3.4 87.0 + 6.7
Diffusion classifier Ace
95.4 + 3.1
42.9 + 9.5
67.6 + 9.0
40.9 + 9.8
68.0 + 9.5
82.3 + 8.3
In Table we present the experimental results for the task of Style Mimicking. To conduct the experiment, we fine-tune the pre-trained LDMs using clean data, GLAZE (Shan et al., (002)) protected data, and the post-processed data by our method as well as other baselines. We then use those fine- tuned models to generate new images mimicking the style of a certain artist and evaluate whether the generated image can successfully mimic the style of the artist We consider two metrics for evaluating the generated image styles by constructing two image style classifier:
1. the CLIP classifier accuracy. Following the GLAZE paper (Shan et al. 2023). we use the pre-trained CLIP model (Radford et al.) 2021) to build style classier to measure whether the generated images belong to the genre of victim artist V. We treat the genre classification provided the WikiArt dataset as the ground truth label, and use the intersection of the 27 historical genres and 13 digital genres from WikiArt, as candidate labels for the CLIP model.
the Diffusion classifier accuracy. We consider another classifier that builds directly upon diffusion models. The Diffusion Classifier (Li al., 2023) is Zero-Shot image classification method, which uses conditional density estimates of images in pre-trained Diffusion models to construct Zero-Shot image classifiers. In our experiments, we used the same set of candidate labels (39 art genres) to build a diffusion classifier for style classification.
For each generated image, we use both the CLIP classifier and Diffusion classifier to evaluate whether the style mimicking succeeds (whether the victim artist V's style falls into the top-3 classification results). Typically, all protection methods aim to lower the classifier accuracy as much as possible to prevent style mimicking from happening if the data usage is unauthorized. As can be seen from Table [. the images generated using clean data samples achieve an average accuracy of 90.8% on the CLIP classifier and 95.4% on the Diffusion classifier. While the generated images using the protected data
7

---

Clean Image
Protected Image
Purified Image
Clean Image
Protected Image
Purified Image
pprsot an
Clank
Proupe:
Style Northen Renisatt Sayle Poat impresiiiiinn Soyle
Arto Pyner Kenchataosl
Aprentin moltumn
Poopp::
ENI
A with well calla
Amas Abreati
Protpc:
Style Art Nourea Modan
Artiec Rappad Kinsheer
ppnon Eungu
Pronge
Task: Style Mimicking
Task: Image Editing
Image Protect Method: GLAZE
Image Protect Method: Photoguard
Figure The experimental results of IMPRESS. Left: groups samples in Style Mimicking, each group of samples is generated by Stable diffusion when using clean images, GLAZE (Shan et al.
2023 protected images, and our IMPRESS purified images for model fine-tuning. Right: 4 groups of samples in Malicious Editing of Images, each group of samples is obtained by editing the clean image, PhotoGuard (Salman et al. 2023) protected image, and our IMPRESS purified image.
samples certainly lower the accuracy to ~ 42%, after our purified process, the generated images can again achieve average accuracy of 87.0% and 82.3% the CLIP classifier and Diffusion classifier respectively. close to the case of clean data samples. By contrast, all the other post- proccssccsiing baselines only achieved limited improved accuracy, clearly outperformed by IMPRESS method. We also present some sample results in Figure f From Figure 44 (left), we can clearly observe that although the GLAZE method successfully mislead the LDM when directly used, after using IMPRESS to purify the protected image, we can still exploit the remaining information.
5.3 Experimental Results Malicious Editing
Table Comparison of malicious editing performances with input data from clean images, Photoguard- images and post-processed protected images by method and baselines. The higher score indicates better alignment with the clean images.
Post-processed
Metric
Protected
JPG
Noise
Resize
Ours
SSIM
0.41 0.06
0.52 + 0.07
0.18 +: 0.05
0.49 = 0.08
0.49 +: 0.08
PSNR
14.24 = 1.57
15.51 1.69
11.06 + 0.94
14.94 + 1.59
15.61 + 2.03
VIF-p
0.11 0.03
0.15 + 0.04
0.06 1 0.02
0.14 0.05
0.16 + 0.04
For the Malicious Editing of Images task, we use pre-trained LDM to edit images following the guidance of certain prompts. Again we consider input images from clean images, images protected by Photoguard (Salman et al. (223). and the post post-processed images by our method as well as other baselines. We followed the same settings as in the Photoguard paper (Salman et al. 2023), using
SSIM /Wang et al. 2004), PSNR, and VIF-p (Sheikh and Bovik (0066) as image similarity algorithms to measure the fidelity of the generated images. We calculate similarity scores between the edited

---

Style Mimicking, Artist: Claude Monet
Image Editing, Prompt: A person an airplane
JPG Compressed
Resize
IMPRESS
JPG Compressed
Resize
IMPRESS
Figure 5: Comparison of different post-processing methods on style mimicking and image editing tasks.
clean images and the edited protected images, well as the post-processed images. Higher scores indicate results that are closer to the edited clean images.
According to Table 2 our proposed IMPRESS method achieved the best performance on the PSNR and VIF-p metrics, scoring 15.61 and 0.16, respectively, suggesting the edited images are still close to true images. We also obtained a score of 0.49 on the SSIM metric, which is the second second-highest score. Note that in malicious editing, even simple image transformation methods can achieve relatively good results on those comparison-based metrics, which has also been pointed out in Salman et al. (2023) and "Sandvval-Seguls et al.) (2023). This phenomenon confirms our point of view: existing image protection technologies are fragile. le. In Figure (right), we show some real examples that while directing applying PhotoGuard can certainly cause the edited images less realistic, after being purified by our IMPRESS, the malicious editing would still go smoothly with no obvious artifact affecting the image fidelity.
we also show some comparison with other post-procent cost-processing baselines on both style mimicking and image editing. We can observe that IMPRESS largely outperforms other baselines for style mimicking while on image editing, all baselines can achieve decent performances in removing the perturbations. This is also consistent with our previous quantitative results, suggesting the imperceptible perturbations on the image editing task is significantly more fragile.
In Figure 5
5.4 Adaptive Image Protection with Consistency-basee Losses
In this section, explore whether it is possible to leverage our consistency- -basee losses for building even better protection methods that could survive our IMPRESS method and successfully prevent unauthorized data usage in diffusion models. Specifically, since we know that keeping x as consistent as possible with (EE(x)) is important, we add this regularization term to the optimization function of the existing protection method design. Take GLAZE an example and we have the following optimization problem:
min [[(((( T)), E(x 50112+ A-max (LPIPS (x,x 8) ())
The coefficient of the added consistency regularization term is denoted B. A meticulous tuning of the weight of the adaptive loss term has been carried out, as demonstrated in Table 3 We have modulated the weight of the adaptive loss term extensively, allowing it to comprise approximately 10% to 95% of the total loss. Our observations reveal that a minuscule proportion of the adaptive loss term in the entire loss leads the experimental results miror those of conventional image protection techniques, whereas an excessive proportion adversely impacts the performance of image protection.
The most pronounced effect of the adaptive protection technology is observable when 3 40, and we show the experimental results Table Tanle and based on that. However, even under this condition, IMPRESS manages attain around 80% accuracy by successfully mitigating the adaptive protective noise. Our experiments indicate that the adaptive design does not genuinely offer robust protection, since IMPRESS still adeptly eliminate the protective noise, allowing the successful execution of style mimicking tasks, it is conjectured that attaining an optimal equilibrium among the three objective terms may pose significant challenge.
To enhance the balance of competing objectives, we have incorporated the Orthogonal Projected Gradient Descent (O-PGD) approach by Gowal et al. 2020) into methodology, delincated

---

Table 3: CLIP classifier Acc for different weight of the adaptive loss term style mimicking tasks
Training data
8
10
8 = 40
3 = 100
8 = 1000
Protected IMPRESS
42.5
41.0
40.8
47.1
77.1
85.6
84.6
81.9
85.7
82.1
Table 4: Experimental Results of Adaptive Protection on Style Mimicking Tasks
Protect Without Adapt
With Adapt
Metric
Clean
Protected
Purified
Protected
Purified
CLIP classifier Ace
90.8 = 3.2
42.5 = 8.3
87.0 = 6.7
40.8 = 9.1
81.9
Diffusion classifier
95.4 1
42,9 9.5
82.3
44.1 9.3
84.0 6.6
Table 5: Experimental Results of Adaptive Protection on Malicious Editing Tasks
Protect Without Adapt
With Adapt
Metric
Protected
Purified
Protected
Purified
SSIM
0.41 0.06
0.49 0.08
0.42 + 0.04
0.52 + 0.05
PSNR
14.24 + 1.57
15.61 + 2.03
14.54 + 1.74
15.90 + 1.23
VIF-p
0.11 + 0.03
0.16 + 0.04
0.14 = 0.04
0.16 + 0.03
Table 6: Experimental results of adaptive defense after using O-pgd. In parentheses the results of the adaptive defense experiments reported in the paper (without the use of O-pgd)
Protect Without Adapt
With O-pgd Adapt
Metric
Clean
Protected
Purified
Protected
Purified
CLIP classifier Acc
90.8
42.5
87.0
48.0 (40.8)
83.9 (81.9)
Diffusion classifier Acc
95.4
42.9
82.3
47.8 (44.1)
84.(84.)
Table the pdf. However, it's discernible that the utilization O-PGD doesn't substantially bolster the efficacy of the adaptive method.
Based on our experimental observations, we hypothesize that the subpar performance of the adaptive method stems primarily from two intertwined complexities: 1) The introduced supplementary loss term complicates the optimization of the loss function. For GLAZE method, the loss function of the adaptive method has three components. Optimizing three different loss components is typically challenging, and striking balance among these components remains an intricate task. 2) The loss term employed for the adaptive method might clash with the inherent loss term of image protection techniques. The purpose image protection technologies is to induce semantical differences between generated images and original ones. Our image purification approach aims make the image maintains its semantic properties (consistency after reconstruction), potentially leading to underlying optimization conflicts. These results suggest that designing adaptive image protection techniques specifically for IMPRESS might inherently be challenging.
6 Conclusion
In this work, proposed IMPRESS, unified platform to evaluate the effectiveness of imperceptible perturbations as a protective measure. We demonstrated that is difficult for the current imperceptible perturbations- based protection methods to prevent certain images from being correctly learned or processed by diffusion models as those imperceptible perturbations could be potentially removed with consistency- based losses. The proposed IMPRESS platform offers comprehensive evaluation on several contemporary protection methods and can used as an evaluation platform for future protection methods.
10

---

References
Omri Avrahami, Ohad Fried, and Dani Lischinski. 2022. Blended latent diffusion. arXiv preprint arXiv:2206.02779 (2022).
Andrew Brock, Jeff Donahue, and Karen Simonyan. 2019. Large Scale GAN Training for High Fi- delity Natural Image Synthesis. In International Conference on Learning Representations (ICLR).
Aurélie Bugeau and Marcelo Bertalmio. 2009. Combining Texture Synthesis and Diffusion for Image Inpainting. In VISAPP 2009- Procedinns of the Fourth International Conference on Computer Vision Theory and Applications. 26-33.
Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. 2021. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition, arXiv preprint arXiv:2/01.073 (2021).
Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. 2023. Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2023).
Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems 34 (2021), 8780-87877 8794.
Pranav Dixit. 2023. Meet The Three Artists Behind A Landmark Lawsuit Against Al Art Generators. BuzzFeedNews.
Benj Edwards. 2022. Artists stage mass protest against Al-generated artwork on ArtStation. Ars Technica.
Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. 2021. Robust unlearnable examples: Protecting data privacy against adversarial learning. In International Conference Learning Representations.
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. 2023. Erasing Concepts from Diffusion Models. arXiv preprint arXiv:2303.07345 (2023).
Ian Goodfellow, Jean Pouget-Abadie. Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In neural information processing systems (NeurIPS).
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. 2020. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 (2020).
Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems 33 (2020), 6840-6851.
Jonathan Ho, Chitwan Saharia, William Chan, David Fleet, Mohammad Norouzi, and Tim Salimans. 2022. Cascaded Diffusion Models for High Fidelity Image Generation. J. Mach. Learn. Res. 23, 47 (2022), 1-33.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. 2021. Unleam- able Examples: Making Personal Data Unexploitable. In ICLR.
Phillip Isola, Jun-Ye Yan Zhu, Tinghui Zhou, and Alexei A Efros. 2017. Image-to-ing image translation with conditional adversarial networks. In conference on computer vision and pattern recognition (CVPR).
Joseph Saveri Law Firm LLP. 2023. Class Action Filed Against Stability AI, Mid-
journey, and DeviantArt for DMCA Violations, Right of Publicity Violations, Un- lawful Competition, Breach of TOS. artists-une unite- iereeein--eeeee in-leeall-- wee.allbaatlleeeee www.baataaiasttteeeeeaaaa aii
https: http://yybrrreee htt//yybbrrswwse rnews com/news/

---

Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. 2018. Progressive Growing of GANs for Improved Quality, Stability, and Variation. International Conference on Learning Represen- fations.
Tero Karras, Samuli Laine, and Timo Aila. 2019. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and paltern recognition. 4401-4410.
Zhifeng Kong and Wei Ping. 2021. On fast sampling of diffusion probabilistic models. arXiv preprint arXiv:2106.00132 (2021).
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. 2020. Perceptual adversarial robustness: Defense against unseen threat models. arXiv preprint arXiv:2006. 12655 (2020).
Vuong Le, Jonathan Brandt, Zhe Lin, Lubomir Bourdev, and Thomas S Huang. 2012. Interactive facial feature localization. In Computer Vision, Florence, Italy, October 7-13. 2012, Proceedings, Part III 12. Springer. 679-692.
2012: 12th European Conference on Computer
Alexander C. Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. 2023. Your Diffusion Model is Secretly a Zero-Shot Classifier. arXiv:2303. [cs.LG]
Bo Li, Kaitao Xue, Bin Liu, and Yu-Kun Lai. 2022b. VQBB: Image-to-image Translation with Vector Quantized Brownian Bridge. arXiv preprint arXiv:2205.07688 (2022).
Changjiang Li, Li Wang. Shouling Ji, Xuhong Zhang, Zhaohan Xi, Shanqing Guo, and Ting Wang. 2022a. Seeing is living? rethinking the security of facial liveness verification in the deepfake era. In 3/st USENIX Security Symposium (USENIX Security 22). 2673-2690.
Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. 2022. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 11661-11771
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR).
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. 2021. Sdedit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Representations.
Mehdi Mirza and Simon Osindero. 2014. Conditional generative adversarial nets. arXiv preprint 1rXiv:1411.177 (2014).
Alexander Quinn Nichol and Prafulla Dhariwal. 2021. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning. PMLR, 8162-8171.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. Diffuusion models for adversarial purification. arXiv preprint 200::2205.007600 (2022).
Pranav
Dixit.
2023.
Don't Be Fooled By Al-Generated Donald Trump
Fakes.
https:// www.feedrwws..............s.ww.. wwt./rtiicl//praaeeeeaaooo
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning. PMLR, 8748-8763.
Evani Radiya-Dixi Dixit, Sanghyun Hong, Nicholas Carlini, and Florian Tramèr. 2021a. Data poisoning won't save you from facial recognition. arXiv preprint arXiv:2 /485/ (2021).
Evani Radiya-Dixit, Sanghyun Hong, Nicholas Carlini, and Florian Tramèr. 2021b. Data Poisoning Won't i Save You From Facial Recognition. arXiv.
12

---

Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. 2022. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06/25 (2022).
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. 2022b. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 10684-10692)
Robin Rombach, Andreas Blattmann, and Björn Ommer. 2022a. Text-guided synthesis of artistic images with retrieval-augmented diffusion models. arXiv preprint arXiv22077.13033 (2022).
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisen Intervention- MICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part 18. Springer, 241.
Jérôme Rony, Eric Granger, Marco Pedersoli, and Ismail Ben Ayed. 2021, Augmented Lagrangian adversarial attacks. In Proc. of ICCV. 7738-7747.
Chitwan Saharia, William Chan, Huiwen Chang, Chris Lee, Jonathan Ho, Tim Salimans, David Fleet, and Mohammad Norouzi. 2022a. Palette: Image-to-image diffusion models. In ACM SIGGRAPH 2022 Conference Proceedings. 1-10.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. 2022b. Photo- realistic text-to-image diffusion models with deep language understanding, Advances in Neural Information Processing Systems 35 (2022), 36479-36494.
Babak Saleh and Ahmed Elgammal. 2015. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.0088 (2015).
Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. 2016. Improved techniques for training gans. In neural information processing systems (NeurIPS).
Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. 2023, Raising the Cost of Malicious Al-Powered Image Editing. arXiv preprint arXiv:2302.066 (2023).
Robin San-Roman, Eliya Nachmani, and Lior Wolf. 2021. Noise estimation for generative diffusion models. arXiv preprint arXiv:2104.00 22660000000000 (2021).
Pedro Sandoval-Segura, Jonas Geiping, and Tom Goldstein. 2023. JPEG Compressed Images Can Bypass Protections Against AI Editing. arXiv preprint 23W.:22333.00233444 (2023).
Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. 2023. GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. arXiv preprint arXiv:2302.04222 (2023).
Hamid R Sheikh and Alan C Bovik. 2006. Image information and visual quality. IEEE Transactions on image processing 15, (2006), 430-444.
Jie Shi, Chenfei Wu, Jian Liang, Xiang Liu, and Nan Duan. 2022. Divae: Photorealistic images synthesis with denoising diffusion decoder. arXiv preprint arXiv:2206. 200000600000 (2022).
Jiaming Song, Chenlin Meng. and Stefano Ermon. 2020a. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02500 (2020).
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. 2020b. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2001..1444 (2020).
Arash Vahdat, Karsten Kreis, and Jan Kautz. 2021. Score- generative modeling in latent space. Advances in Neural Information Processing Systems 34 (2021), 1227--11302.
Tengfei Wang, Ting Zhang, Bo Zhang, Hao Ouyang, Dong Chen, Qifeng Chen, and Fang Wen. 2022. Pretraining is all you need for image-to-image translation. arXiv preprint arXiv:2205. 12952 (2022).
13

---

Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility structural similarity. IEEE transactions on image processing 13, 4 (2004), 600-612.
Julia Wolleb, Robin Sandkühler, Florentin Bieder, and Philippe C Cattin. 2022. The swiss army knife for image-to-in to-image translation: Multi-task diffusion models. arXiv preprint arXiv:2204.0222 00264 (2022).
Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dim- itris N Metaxas. 2017. Stackgan: Text to photo-realistic image synthesis with stacked generative adversarial networks. In Proceedings of the IEEE international conference on computer vision. 5907-5915.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. 2018. The unrea- sonable effectiveness of deep features as pereeptual metric. In Computer Vision and Pattrn Recognition (CVPR).
Min Zhao, Fan Bao, Chongxuan Li, and Jun Zhu. 2022. Egsde: Unpaired image-to-image translation via energy-guided stochastic differential equations. arXiv preprint arXiv:2207.06633 (2022).
Jun-Yan Zhu, Tacsung Park, Phillip Isola, and Alexci A Efros. 2017. Unpaired image-to- to-eeettommmee translation using cycle-consistent adversarial networks. In international conference computer vision(ICCV).
14

---

A Algorithm of IMPRESS
The following outlines the algorithmic process of our proposed IMPRESS method for the removal of protective noise.
Algorithm 1 IMPRESS
Input: Image encoder E, image decoder D; hyperparameters a.7) L
Initialize Xpur Xpth (N,, I²
2: for iter = 1, 2, ... ,N do
3: Lsim = Xpur (x((x)r) )
4: Lipips = max max(LPIPS) Xpur Xpab) AZ.
5:
L C-mmmm+ + Liipss
6: Xpur f Xour V2
7: Xpur Clip(Xpur: min = =,, max 1)
8: end for
9: Return Xpur
B Detail of Experiment
In this section, we have provided a detailed introduction to our experimental setup. The random seed for all experiments set to 0, and our experiment code publicly available in https 7/github. com/ AwwAAAAuAA Impress
Style Mimicking Since we do not have access to unreleased artworks, we conduct all the style mimicking experiments the WikiArt dataset (Saleh and Elgammal] 2015). The WikiArt dataset contains paintings from 195 famous artists throughout history. The dataset consists of 42,129 training images and 10,628 testing images. WikiArt categorizes all artists into 27 different genres (c.g.. Impressionism, Cubism), we remove artists from the WikiArt dataset that the CLIP model cannot accurately classify (classification accuracy less than 80%). Then, we select nine artists with the most artworks among the remaining artists, eight of which are used for testing the model's 's performance, and the remaining artist serves as the validation set for adjusting hyperparameters.
For GLAZE (Shan et al., 2023), we basically follow the original paper's setting: given a victim artist V. randomly select 124 of their works. Then, we use the ViT+GPT2 model to generate a title for each work and attach the victim artist V's name to the generated title as the prompt Next, randomly draw 24 works from these 124 art pieces as the style imitation training set, and the remaining 100 as the test set. Afterward, we use the table-diffusion-22 --rooo-------ae 2---e model released on Hugging Face as the initial pre-trained model weights and fine-tune on the training set. Afier obtaining the fine-tuned LDM, we generate imitation works in the style of the victim artist using the prompts from the training set. Finally, we selected 8 artists and randomly extracted 24 pieces for fine-tuning the diffusion model and 100 pieces for validation, totaling 800 evaluation samples.
For fine-tuning the diffusion model, use the fine-tuning script released with the model, training for 500 steps on the training set with a learning rate of x 10-6, For GLAZE, we choose perturbation budget of p 0.05, regularization coefficient a 30, and train for 500 steps using the Adam optimizer with a learning rate 10-2, For our method, we set the perturbation budget to 0.1, regularization coefficient a 0.1, and train for 3,000 steps using the Adam optimizer with learning rate of 10-2
Malicious Editing of Images We use the Helen (Le et al. 2012) dataset for the experiments in the Malicious Editing of Images task. Helen is an annotated facial image dataset, consisting of 2,330 images sourced from Flickr. The annotations include facial landmarks and masks of facial features such eyes, nose, etc. The dataset also includes masks for the entire face.
For malicious editing images, We utilize the code and settings made public by Photoguard(Salman et al. (023) for image protection. The purpose of the Malicious Editing of Images task is to modify the background of photo. Hence, we selected the images with the smallest face-to-image ratio from the Helen dataset and their corresponding face masks (the sample size of Photoguard experiment
15

---

is 60). Subsequently, we use Photoguard to generate protective noise for these images. Then, we attempt to modify the images using diffusion model with the prompt "A person an airplane".
We generate noise using the most powerful Diffission attack-1.2 method Photoguard, and all hyperparameters adhere to the settings in the open-source code. We the runwaym//stable- diffusion-inpainting model released on Hugging Face to modify images, with guidance strength of 7.5 and 100 diffusion steps. For our method, set the perturbation budget to p = 0. regularization coefficient a 10- and train for 1,000 steps using the Adam optimizer with learning rate of 5 x 10
C More Experimental Results
Image
Protected Image
Purified Image
Image
Protected Image
Purified Image
Prompt: A persen
Alfecch
Prompt person restaurntt
Antia Bopiad Kidwes
Ariac Camile Booar
Promptt A person with red
Arti: Cenomr
Adtaa Chick Chilke Roosn
Prompt person Europe
EEROPPNE
Task: Style Mimicking Image, Protect Method: GLAZE
Task: Image Editing, Image Protect Method: Photoguard
Figure 6: More Experimental Results
16

---

D Ablation Study
0.86
CLI ACC
0.84
0.82
0.82
0.78
0.80
0.76
0.01
0.05
0.1
0.15
0.2
0.01
0.05
0.1
0.15
0.2
Ag
(a) The Effect of A
(b) The Effect of
Figure 7: Ablation Study of Style Mimicking
15.8
A
15.6-
15.5
15.5
15.4
15.4
15.3
15.3-
15.2
15.2
15.1
15.1
14.
15.0
14.8
14.9
0.01
0.05
0.1
0.15
0.2
0.001
0.005
0.01
0.02
0.05
Ar
(a) The Effect of A
(b) The Effect of a
Figure 8: Ablation Study of Malicious Editing of Images
In this section. we analyze the effects of two hyperparameters in our method: and Åg. Among them, is the balance weight in the entire optmmzztton objective of Impress, and Ar is the threshold of the LPIPS regularization term. Here, we use the CLIP evaluation indicator in the Style Mimicking task and the PSNR indicator in the Malicious Editing of Images task to evaluate the impact of hyperparameters. The evaluation results are shown Figure 7 and Figure & For the threshold A of the LPIPS regularization term, by observing Figure 7(a) and Figure 8(a) we can see that when A L large, the LPIPS term loses its constraining effect. This may cause the purification process to make excessive modifications to the original image, thereby destroying the semantic information such as style/content the original image, resulting in poor performance. When A, too small, the LPIPS regularization term dominates the optimization process. This causes the purified image to be too similar to the protected image, retaining some protective noise, thereby affecting performance. Similarly, by observing Figure 7(b) and Figure 8(b) we can find: When the balance weight is too large, it will cause the weight the LPIPS term to be too large, causing similar results to when A is too small, that is, retaining too much protective noise, thus leading decrease in purification effect. When a is too small, the LPIPS term loses its constraining effect.
At the same time, by comparing Figure 7 and Figure g we found that the Photoguard method is more sensitive to hyperparameters. We believe this may because the disturbance is constrained by L2 in Photoguard, which leads to some obvious point-like artifacts on the image. These point-like like artifacts may play a "trigger" role. When they cannot be effectively removed, the purification effect will decrease.
17

---

Raphael Kirchner
7.5
Camille Pleaarr
Pyotr Konchalovsky
Lg distance between 2pur and
Childe Hasson
7.0
Paul Cozanne
Claude Monet
6.5
Albrecht Durer
Eugene Boudin
6.0
5.5
5.0
4.5
4.0
500
1000
1500
2000
2500
3000
Purify iterations
Figure 9: L2 distance between Zpur and z
E A Metric-based validity study
To validate the effectiveness of our method, we calculated the distance of the embedding Zpur of the purified image in the diffusion model relative to the embedding of the clean image in the Style Mimicking task during the purification process. Please note that IMPRESS, cannot get the clean image, that is, we do not know
entire purification process of
We plotted the results in Figure 9 For protected image. we recorded the embedding Zpur after each step in the purification process using IMPRESS, totaling 3000 steps (consistent with our experimental setup). Then we normalize and all pur and then calculate the T.2 distance between Zpur after each step and z, thereby obtaining the L22 distance between Zpur after each step and z during the purification process of this image. Finally, we average the results obtained from all pictures selected from each artist. We plotted the average value of each artist in Figure as separate curve.
As can be seen, for all artists, the Le distance between Zpar after each step the purification process and z gradually decreases. This means that the feature vector of the purified image in the model is more similar the clean image, which also means that our method effectively removes the protective noise and is effective for all kinds of different types of artworks.
Real-World Style Mimicking Service
We tested our method on a real-world image generation service website. scenario.com is a image generation service provider that allows users upload set of images and mimic the style of these images, and then generate images with similar styles based on the prompts provided by the user. We randomly selected the works of 4 artists in our experiment as the targets for imitation. then used scenario.com com to mimic clean images, images protected by GLAZE, and images purified by IMPRESS respectively, and generated process is consistent with the data used in the default parameter settings in our experiment, and the results are shown in Figure I0 As can be seen, GLAZE effectively protects the images on real-world services. The style of the image protected by GLAZE is completely different from the original image, and the content of the picture is severely damaged, sometimes is difficult to identify the content of the image. On the other hand, new images generated by imitating IMPRESS purified images are highly consistent in style and content with those generated by imitating clean images, which implies that our method can effectively remove protective noise.
sets of new images for each. The training data used in the imitation
18

---

Souree: Image
Image
Purified Image
Souree:
Clesn Image
Protected Image
Purified Image
SAITES ina drow
Arta: Claxte Monet
Raphad Kirchee
biddg
builling with dleck
Source:
Imtaee
Protected Image
Purified Image
Clean Image
Protected Image
Purified Image
11000 a100c-ppod 3pond with bonts
a poople Rold
Frtl and reptaali
Artiat Pynn Kondhulovkky
Artsc Albrectt
THA bottng cate in 33 right
Figure 10: The images generated using the image style imitation service provided by scenario.com to
mimic clean images, images protected by GLAZE, and images purified by IMPRESS. The prompt used to generate each group of images is shown the left side of each group. All images generated using the default parameters provided by scenario.com.
G Impact of IMPRESS Clean Images
After testing, our method does not affect clean data. We conducted an experiment where IMPRESS was directly applied clean images. For the Style Mimicking task, the ACC of the CLIP Classifier was 91.2%, and the ACC of the Diffusion Classifier was 92.5%, both of which were close to the results obtained from fine-tuning the model directly using clean data. For the Malicious Editing of Images task, SSIM, PSNR, and VIF-p were respectively 0.59, 16.70, and 0.23, significantly higher than other experiments. Figure TT shows the images obtained by using IMPRESS purify clean images and the results of using clean images directly in the two tasks, showing that our method hardly impacts clean images.
H Explanation of Differences in GLAZE Experimental Results
In the original GLAZE paper, the selection method of the target style T is to randomly choose style that is significantly different from the victim artist V, but the paper does not provide specific style selection data and hyperparameter settings. We attempted to reproduce the target style selection method proposed the original GLAZE paper as much as possible and conducted multiple random experiments. Using the same data and default hyperparameters. the average accuracy of the image generated by the Protected image as training data in the CLIP classifier is 59.8% when using the target style selection method of GLAZE, while the average result after purification by IMPRESS is 87.9%. We found that the GLAZE method is very sensitive to the target style T.. For a particular artist, reasonable target style can make the average accuracy of the GLAZE method in the CLIP classifier less than 10%.
To ensure the consistency and reproducibility of the experiment, we choose to use "Cubism by Picasso" as the target style our tests, because "Cubism by Picasso" one of the target style prompts used by GLAZE in the example results shown in the paper, and clear protective effect can be seen. With the target style unified, "Cubism by Picasso" is also the best performing target style. The specific results for each artist are shown in Table 7
19

---

Task:
Style Mimicking
Image Editing
Source:
Clean Image
Purified Clean Image
Clean Image
Purified Clean Image
Samplet:
Sample2:
Figure 11: The experimental results of IMPRESS on clean image. For the Style Mimicking task, the "Clean Image" column presents results generated by model using clean images fine-tuning data, and the "Purified Clean Image" column shows results from models using clean images purified by IMPRESS as fine-tuning data. For the Malicious Editing of Images task, the "Clean Image" column represents the results of image editing using clean images as the target, while the "Purified Clean Image" column presents the results of image editing using clean images that have been purified by IMPRESS as the target.
Table 7: All Artists Results
Artist
Metric (%)
Clean
Protected
Post-processed by IMPRESS
CLIP classifier Ace
88.0
77.0
91.0
Raphael Kirchner
Diffusion classifier Acc
93.0
87.0
93.0
CLIP classifier Acc
80.0
2.0
88.0
Camille Pissarro
Diffusion classifier Acc
100.0
5.0
61.0
CLIP classifier Acc
76.0
34.0
68.0
Pyotr Konchalovsky
Diffusion classifier Acc
90.0
41.0
90.0
CLIP classifier Acc
99.0
53.0
95.0
Childe Hassam
Diffusion classifier Acc
98.0
47.0
65.0
CLIP classifier Acc
93.0
6.0
73.0
Paul Cezanne
Diffusion classifier Acc
100.0
31.0
98.0
CLIP classifier Acc
93.0
20.0
95.0
Claude Monet
Diffusion classifier Acc
100.0
16.0
91.0
CLIP classifier Acc
99.0
78.0
91.0
Albrecht Durer
Diffusion classifier Acc
89.0
82.0
81
CLIP classifier Acc
98.0
70.0
95.0
Eugene Boudin
Diffusion classifier Acc
93.0
34.0
80.0
CLIP classifier Acc
90.8
42.5
87.0
Average
Diffusion classifier Acc
95.4
42.9
82.3
Comparison with More Baseline Methods
In this section, we compare our proposed IMPRESS with four additional baseline methods: 1)
traditional denoising method (e.g., low-pass filtering): 2) enhanced preprocessing approaches (re-
20

---

size+flipping+JPPl compression); 3) robust training methods (e.g., Radiya--iini Dixit et al. 202 (
4)
advanced denoising approaches (e.g., Diftpure (Nie et al., 2022)
Table 8: Comparison of IMPRESS with other baselines on Style Mimicking tasks
Post-processed Resize + Flip JPG
Metric
Clean
Protected
Low-pass Filtering
Robust Training
Ours
CLIP classifier Ace
90.8
42.5
51.3
52.9
46.5
87.0
Diffusion classifier Ace
95.4
42.9
52.1
52.3
47.0
82.3
Table 9: Comparison of IMPRESS with other baselines Malicious Editing tasks
Post-processed Resize Flip + JPG
Metric
Protected
Low-pass Filtering
Diffpure
Ours
SSIM
0.41
0.43
0.45
0.48
0.49
PSNR
14.24
14.52
14.68
14.62
15.61
VIF-p
0.11
0.12
0.14
0.14
0.16
Table 8 and show the experimental results for those additional baselines. For the Style Mimicking task, we have incorporated additional baselines, namely low- low-pass filtering, resize + flipping + JPEG compression, and the robust training method by Radiya-Dixiitttttt et al. (2021a). For the Malicious Editing task, we have added low-pass filtering, resize flipping + JPEG compression, and Diffpure (Nie et al. 2022) baselines. It can be observed that approach still achieved the best results comparing with those additional baselines. Note that robust training method (Radiya-Dixir et al. 2021a) is not tested malicious editing task since it does not involve model fine-tuning. And Diffpure (Nie et al. 2022) is not tested on style mimicking task since requires a pre-trained non-latent diffusion model on the target distribution (which is of the major limitation of this method) but hard find one on artist data currently.
Computational Complexities
The extra computations needed for our method is also not very significant. Under our experimental setup, the purification of single image took average of 141 seconds. In comparison, GLAZE took an average of 90 seconds to compute adversarial noise for an image, while Photoguard required more than 600 seconds average to perform the computations. In fact, due to the large size of the stable diffusion model, fine-tuning the model actually takes much longer time than optimizing those images, thus believe the computational cost will Acceptable.
21


Reviews:
[{"review_id": "NOpFthxbS2", "reviewer": "Reviewer_UShu", "summary": "Diffusion-based image generation models, such as Stable Diffusion or DALLE2, are able to learn from given images and generate high-quality samples following the guidance from prompts. However, such ability also brings unauthorized data usage problem. In response, several attempts have been made to protect the original images from this problem by adding imperceptible perturbations. The author discovered that it is possible to render these methods ineffective by purifying the image and disabling the added perturbation. They conduct experiments for style mimicking and malicious editing tasks to comprehensively evaluate the risks of using imperceptible perturbations.", "questions": "1.\tWhy the adaptive image protection with consistency-based losses in section 5.4 does not really bring true protection? What is the underlying reason behind it?\n2.\tHow effective is the proposed method attacking against other methods which protect the original images from style mimicking or malicious editing?\n3.\tHow do you solve the optimization problem in Eq.(4.1)? Is it through deep learning methods or mathematical methods, please provide some more details about the algorithm.\n\n---------------------------------\nI read the rebuttal and the questions are answered. My main concern is the novelty of the methodology.", "limitations": "It is recommended that the authors explain the limitations of the proposed method, such as potential negative social impact (i.e., someone may do malicious editing of images by using your approach),  limited applicable scenarios and so on.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1.\tThis paper identifies a common drawback in existing data protection methods by adding imperceptive perturbations. \n2.\tThe method proposed by the authors is straightforward in its implementation but yields impressive results.\n", "weaknesses": "1.\tThe method proposed in this article is based on empirical findings and lacks profound theoretical support, which is slightly incongruent with the theme of the NeurIPS conference.\n2.\tThis work has limited novelty because this approach is commonly used in the detection and removal of adversarial examples.\n3.\tThe experimental results exhibited in the article have limited scope and quantity, which makes it difficult to provide strong support for the effectiveness of the method.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer UShu\n\nThank you for your valuable comments!\n\n**Q1:**:  Lacks theoretical support for NeurIPS\n\n**A1:** Indeed our paper does not provide much theoretical results and we plan to leave the theoretical study as our future work. Nonetheless, we believe it still represent significant contributions as it points out an major drawback for existing imperceptible perturbations based defenses and new perspectives on the design of new protection methods. Also we believe empirical-based works are common in NeurIPS and it is a bit unfair to reject a paper simply because it is empirical-based.\n\n**Q2:** Similar approach is used in detection/removal of adversarial examples\n\n**A2:** We respectively disagree and believe our work in novel in several aspects: \n1) The issue we delve into (vulnerabilities of imperceptible perturbations based defenses) is new and critical (as also mentioned by Reviewer EvE8, vDR3). Currently there is no rigorous work out there to pinpoint potential vulnerabilities within these protection methods.  \n\n2) The observations and perspectives we bring in this paper is new: existing image protection methods with imperceptible perturbations can result in noticeable differences between the protected image and the reconstructed image.  \n\n3) Similar loss terms does not necessarily mean the techniques are the same (e.g., most model training works share the same cross-entropy loss but it does not mean they are all the same). Due to diffusion model fine-tuning, removing those perturbation in our work is fundamentally different from removing adversarial examples (adversarial examples considered purely evasion attack while our case is more like poisioning as the user will fine-tune the model with the perturbed data).\n\n\n**Q3:** Insufficient experimental data.\n\n**A3:** We have supplemented our experiments with additional data (see Table 1, 2 in the pdf). We augmented the datasets for both GLAZE and Photoguard by 50%.  We observe that the results after supplementing the data align closely with the original results. We will add these results to our paper after completing tests on the baseline and reproducibility tests. Additionally, the data quantity in our test set already surpasses that in the test sets of both the GLAZE and Photoguard papers.\n\n**Q4:** Inefficacy of the adaptive protective method\n\n**A4:** Please see **CA1** in our response to all reviewers.\n \n**Q5:** Other image protection techniques\n\n**A5:** We apologize for the confusion. Currently, there are no other image protection techniques specifically designed for diffusion models. The two image protection techniques we tested (GLAZE and Photoguard) both emerged in the past six months. We will emphasize this point in our paper. If new image protection methods emerge, we will promptly follow up and test them.\n\n**Q6:** How to solve the optimization problem in Eq.(4.1)\n\n**A6:** We employ deep learning techniques to optimize our objective function. We set the perturbation budget to $p=0.1$, the regularization coefficient to $\\alpha=0.1$, and use the Adam optimizer with a learning rate of $10^{-2}$ for 3,000 iterations. More details on the experiments can be found in Appendix B.\n\n**Q7:**: Clarify the limitations of the methodology and the scenarios in which it can be applied.\n\n**A7:** : Thank you for your comments, In our paper, we will include the following note: \"Please be aware that the proposed IMPRESS method might be misused, such as eliminating the protective noise from the current protected artworks. This indicates that the current imperceptible perturbations for image generation models is still imperfect. We urge researchers to investigate more robust image protection techniques and advise caution when relying on existing protection technologies until more secure methods are developed\""}, {"review_id": "kOw3BfL7Fv", "reviewer": "Reviewer_vDR3", "summary": "In this work, the authors showed some intellectual protection methods for diffusion methods via imperceptible perturbations could be removed, hence questing the effectiveness of such methods. The authors observed perceptible inconsistency between the pair of original samples and the reconstructed ones by diffusion models, and then proposed IMPRESS method to disable these imperceptible perturbations. In the experiments, the authors tried to break two image protection methods, namely GLAZE and Photoguard, and showed their advantage over some known post-processing methods. ", "questions": "See Weakness.", "limitations": "NA.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1). This work studies an interesting problem that questions the real effectiveness of the existing image protection methods.\n2). The empirical observation between the differences of protected images and reconstructed images seem appealing.\n3). The paper presents well and is easy to follow.\n", "weaknesses": "1). The two terms in the proposed loss (in Eq.4.1) are common denoising operators and are straightforward to come up with. This may hinder the technical novelty of this work.\n2). There have been many denoising methods in the computer vision community, either deep learning based or conventional methods. Could these methods be modified as a proxy of the proposed method? \n3). This paper lacks baseline methods. Why not compare with advanced denoising methods? \n4). Though the methods to break are based on imperceptible perturbations, there can also be perceptible ones, please discuss whether your method can deal with such perturbations.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer vDR3\n\nThanks for the constructive comments!\n\n**Q1**: limited novelty\n\n**A1**: We respectively disagree and believe that our work is novel in the following aspects:\n \n1) The issue we delve into (vulnerabilities of imperceptible perturbations based defenses) is new and critical (as also mentioned by Reviewer EvE8). Currently there is no rigorous work out there to pinpoint potential vulnerabilities within these protection methods.  \n \n2) The observations and perspectives we bring in this paper is new: existing image protection methods with imperceptible perturbations can result in noticeable differences between the protected image and the reconstructed image.  \n\n3) Similar loss terms does not necessarily mean the techniques are the same (e.g., most model training works share the same cross-entropy loss but it does not mean they are all the same). Removing noise for diffusion model’s training data is a new task that is totally different from prior ones. \n\n**Q2**: Employ computer vision denoising techniques & incorporate advanced baselines.\n\n**A2**: Please see **CA2** in our response to all reviewers.\n\n**Q3**: What about perceptible perturbations?\n\n**A3**: Our method is build upon the assumption that the perturbation noise is inpercpetible and the losses are designed based on such an assumption. This assumption is also reasonable as percpetible perturbations can be easily identified by the model trainer and thus have higher chance to be discarded during model fine-tuning. Currently, the protection with perceptible perturbations is beyond the scope of this paper. However, this is an intriguing idea, and we are inclined to delve deeper into this matter in our subsequent research.\n\n"}, {"review_id": "dCYut6FHne", "reviewer": "Reviewer_ULFY", "summary": "This work is focused on testing the vulnerability of approaches that prevent unauthorized data usage in diffusion models. The paper shows that existing approaches for this problem are fragile, and leads to difference b/w original and diffusion reconstructed image. Then, based on the previous observation the paper proposes a method named IMPRESS to purify the modified images based on a consistency loss. The results show that the proposed approach can successfully purify the imperceptible modifications on two existing approaches, GLAZE and PhotoGuard. Lastly, the work shows that an adaptive variant of GLAZE, that takes into account the proposed consistency loss still can't defend against IMPRESS.", "questions": "1. The approximation of consistency loss from the diffusion model to the encoder-decoder is unintuitive. Does this imply the IMPRESS approach is independent of the diffusion model? \n2. Related to the above, how would the IMPRESS approach work for a non-latent diffusion model?", "limitations": "See the weaknesses above.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The writing quality of the paper is satisfactory. The main approach is easy to follow, and important preliminaries are clearly explained.\n2. The results show that the proposed approach can surpass simple baselines. Both PhotoGuard, and GLAZE function as a form of adversarial attack, and thus should be vulnerable to similar transformations such as JPEG Compression, and geometric transformations. The work considers these as baselines and shows for GLAZE the proposed approach works better. For PhotoGuard, all baselines perform equivalently and are able to purify the protected image.", "weaknesses": "1. The overall contribution of this work may not be significant. The work relies on solving an expensive optimization problem and shows that imperceptible perturbation cannot prevent unauthorized data usage. However, it also shows that simple preprocessing approaches such as JPEG, and Resizing are effective against PhotoGuard. A similar observation was already made by [1]. The results on GLAZE show better performance, but the work doesn't consider more optimized baselines such as what happens for different JPEG compression ratios, or JPEG + Resizing + other geometric transforms. \n\n2. The computational complexity of recovering the purified image is not discussed, especially w.r.t baselines.  How long does the proposed approach take? JPEG and Resizing are fairly inexpensive operations compared to the proposed approach that relies on solving an optimization problem.\n\n[1] Sandoval-Segura, Pedro, Jonas Geiping, and Tom Goldstein. \"JPEG Compressed Images Can Bypass Protections Against AI Editing.\" _arXiv preprint arXiv:2304.02234_ (2023).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer ULFY\n\nThanks for the constructive comments!\n\n**Q1:** More Complicated Baselines\n\n**A1:** Please see **CA2** in our common response to all reviewers\n\n**Q2:** The Impact of Different JPEG Compression Rates\n\n**A2:** In our paper, we used the JPEG compression rate that provided the best protection. Table 6 in pdf shows the supplementary results for different JPEG compression rates. Please note that when we say \"compression rate of 15%\", it means we compress the image to only 15% of its original size, which is a rather strong compression.\n\n**Q3:** Computational Complexities\n\n**A3:** Please see **CA3** in our response to all reviewers.\n \n\n**Q4:** Is the IMPRESS approach independent of the diffusion model?\n\n**A4:** We only made the approximation for the sake of saving computational cost. The approximation is feasible since the diffusion layer’s goal is to **reconstruct the the original latent vector**.  Here's a detailed derivation:\n\nIn a Latent Diffusion Model, denoted as $f_{LDM}$, the following steps are taken:\n$$ \nz_0 = \\mathcal{E}(x),\n\\tilde{z_0} = diff(z_0),\n\\tilde{x} = \\mathcal{D}(\\tilde{z_0}) \n$$\nHere, $diff(.)$ represents the diffusion process. Initially, noise is added to $z_0$ over multiple steps, resulting in $z_1, z_2, .. z_T$. Next, the denoising model, $\\epsilon_{\\theta}(z_t, t, \\tau_{\\theta}(y))$, progressively denoises $z_T$ to obtain $\\tilde{z}$. The model $\\epsilon_{\\theta}$ is trained using the following loss function:\n$$\nL_{LDM} = E_{\\mathcal{E}(x), y, \\epsilon \\sim \\mathcal{N}(0, 1), t }\\Big[ \\Vert \\epsilon - \\epsilon_{\\theta}(z_{t},t, \\tau_{\\theta}(y)) \\Vert_{2}^{2}\\Big] \n$$\nAs shown above, the predicted noise by the denoising model, $\\epsilon_{\\theta}(z_{t},t, \\tau_{\\theta}(y))$, aims to approximate the noise $\\epsilon_t$ introduced during the forward process when $\\tau_{\\theta}(y) = 0$. Thus, in a well-trained LDM, the term $\\Vert \\epsilon_t - \\epsilon_{\\theta}(z_{t},t, \\tau_{\\theta}(y)) \\Vert_{2}^{2}$ is nearly 0. This implies that $\\tilde{z_0} \\approx z_0$. Combining with the equation above, we deduce:\n$$ \nf_{LDM} \\approx \\mathcal{D}(\\mathcal{E}(x)), \\text{when } \\tau_{\\theta}(y) = 0. \n$$\n\nIMPRESS can still be applied without the approximations (and potentially achieve even better results) at the cost of larger computational cost of backpropagation through the diffusion layers.\n\n**Q5:** Application of IMPRESS on Non-Latent Space Diffusion Models\n\n**A5:** As we mentioned in A4, IMPRESS can potentially be applied without the approximations (directly over the entire model), however, the current image protection techniques, (e.g., GLAZE and PhotoGuard), are primarily rely on latent space diffusion models. These techniques specifically \"attack\" the encoder-decoder components of these models. Hence, we cannot test the non-latent space diffusion models currently.\n"}, {"review_id": "x5yjB1Qury", "reviewer": "Reviewer_DYEa", "summary": "This paper proposes IMPRESS, a new purification method to remove imperceptible perturbations that are claimed to be able to prevent unauthorized data usage in diffusion-based image generation. Specifically, IMPRESS aims to produce a purified version of the perturbed image by minimizing the distance between the perturbed image and its reconstructed image as well as the distance between the perturbed image and the purified image. The authors also consider a challenging scenario where protection can be adapted to IMPRESS. ", "questions": "See weaknesses", "limitations": "I do not find anywhere discussing Broader Impacts and Limitations, although the authors check \"yes\".", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- Very good writing and thorough review of related work\n- Clear motivation, especially for the elegant design of the consistency loss\n- Sufficient descriptions of technical details of IMPRESS and the experimental settings\n- Two SOTA protection methods in two tasks are considered.", "weaknesses": "- Limited comparison to (potential) baselines. \n1) First of all, as acknowledged by the authors in Section 5.3, previous work (Salman et al. and Sandoval-Segura et al., 2023) has already identified the effectiveness of JPEG compression in solving the studied problem. Therefore, it should be explicitly stated in the Introduction that this paper is not the first to study whether “Imperceptible Perturbations Really Prevent Unauthorized Data Usage”. One specific question: What does it mean by “compression rate as 15%”? Is the quality factor 15% (stronger compression) or 85%? This is important because Sandoval-Segura et al. 2023 have found that choosing strong compression is the key to purifying the perturbations.\n2) In addition, the countermeasures that are considered in the original papers of GLAZE and PhotoGuard should also be compared. This is necessary because this paper considers two different metrics (i.e., style classification scores) for measuring the effectiveness of IMPRESS. It is not clear whether those originally considered countermeasures can already achieve very good results in these two metrics.\n3) Other popular purification methods should also be tested. For example, existing work has shown that diffusion-based purifications are very effective in removing adversarial perturbations. Such methods should be definitely compared.\n\n- Limited explorations of adaptive attacks. Table 3 demonstrates that adaptive attacks show similar results and even worse results than non-adaptive attacks. This is surprising since additional knowledge is incorporated, and it also gives a sign that the adaptive attack may not be properly designed. The authors should either consider better designs or explain why this weird phenomenon happens.\n\nTypos:\n\nLine 232: should be some grammatical mistake for “setting reproduced the code”\n\nLine 309: whether is possible -> whether it is possible", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer DYEa\n\nThanks for the constructive comments!\n\n**Q1**: More Baselines\n\n**A1** Please see **CA2** in our common response to all reviewers\n\n**Q2**:  The first to study Imperceptible Perturbations\n\n**A2**:  Thank you for your suggestion. What we want to say here is prior works are only targeting the PhotoGuard method alone and there is no systematic study on the general type of imperceptible perturbations. Nonetheless, we admit that the claim in the paper may sound a bit misleading and we will revise the claims made in our paper.\n\n**Q3**:   Interpretation of \"JPEG compression rate\"\n\n**A3**:  We apologize for any confusion caused. In our paper, when we mention \"compression rate of 15%\", we are referring to a quality factor of 15%. This implies that the storage space occupied by the compressed image is only 15% of the original, representing a stronger compression. Additionally, we have appended experimental results under other JPEG compression quality factors for the Style Mimicking task, which is shown in Table 6 in the pdf. It's evident that the best performance is achieved when the quality factor is at 15%. We observed that a lower quality factor leads to significant image distortion.\n\n**Q4**:  . Inefficacy of the adaptive protective method:\n\n**A4**:   Please see **CA1** in our response to all reviewers.\n\n**Q5**:  Minor typos\n\n**A5**:  Sorry for the confusion. We have revised the paper as suggested.\n"}, {"review_id": "GvthQkrvl5", "reviewer": "Reviewer_EvE8", "summary": "This paper investigates the reliability of methods for imperceptibly perturbing images to degrade the performance of latent diffusion models for style mimicry or editing. The authors observe that imperceptible perturbations designed to hamper diffusion-based image generation systems often result in perceptible artifacts when the “protected” image is reconstructed with a diffusion model. Noting that unprotected images typically do not exhibit such behavior, the authors propose a “purification” method in which images are optimized with respect to both a consistency objective (such that diffusion reconstruction preserves the purified image) and a similarity objective (such that purification does not perceptibly alter the image). The proposed purification method effectively mitigates two recent imperceptible perturbation methods for image editing and style transfer, indicating that stronger techniques are needed to protect image data from unwanted diffusion-based manipulation.\n", "questions": "It is interesting that the simple consistency objective is sufficient to defeat protective perturbations, especially when optimized only with knowledge of the image encoder and decoder. Does this result imply that existing protection approaches primarily leverage the image encoder and decoder rather than the latent diffusion model itself? It would also be interesting to see whether there are other efficient ways to approximately optimize through the latent diffusion process.\n\n(The following is more of a thought / comment than a question). In the adversarial example literature, methods have been proposed to tackle optimization with respect to competing objectives (e.g. perturbation effectiveness and imperceptibility). Often, one objective dominates the optimization even when loss values are scaled with well-chosen weights, leading to poor results and inaccurate estimates of robustness. The method of Bryniarski et al. [1] seems to be effective in allowing adaptive adversaries to better balance multiple constraints. Such an approach might lead to more effective balancing of the similarity and consistency objectives not just for the IMPRESS purification method, but for an adaptive adversary like the one proposed in section 5.4 of the paper. I think the simple projected gradient descent method and loss formulation the authors propose in this paper is fine -- it shows the effectiveness of the core idea without the need for extensive tweaks -- but it would also be interesting to see future work incorporate more recent techniques from adversarial machine learning into the protection and purification methods.\n\n[1] Bryniarski, Oliver and Hingun, Nabeel and Pachuca, Pedro and Wang, Vincent and Carlini, Nicholas. \"Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent.\" ICLR 2022.", "limitations": "Yes.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The issue of protecting intellectual property such as images from unauthorized use by the operators of generative models is timely and significant.\n\nThe proposed purification approach — essentially an image adversarial attack using a simple encoder-decoder consistency objective, projected gradient descent, and Gaussian perturbation initialization — appears straightforward to implement, and is effective in both fine-tuned style mimicry and one-shot image editing scenarios.\n\nThe authors evaluate their purification method against adaptive perturbations optimized with knowledge of the purification objective and find their method still remains effective\n\nThe authors include reasonable protection methods (GLAZE, Photoguard) and purification baselines (JPEG compression, Gaussian noise, resizing) in their experiments.\n\n\n\n", "weaknesses": "Figures 1 and 4 are unnecessarily hard to read. For the style mimicking experiments, the labels for each column (\"clean image\", \"protected image\", \"purified image\") misleadingly indicate that the images below are actual clean/protected/purified images from the dataset when in fact they appear to be images generated by a model fine-tuned on either clean, protected, or purified images. For the editing experiment, it would be better to actually show the input clean/protected/purified image in addition to the edited versions. This might require a tweak to the figure format or perhaps separate figures, but I think that more legible figures would better communicate the authors' proposed approach.\n\nTo justify the choice of tasks on which the proposed method is evaluated, the authors should more clearly indicate that they evaluate against two recent imperceptible protection methods on the specific tasks for which these protections methods were proposed. Otherwise, the choice of task (e.g. background editing) could come off as arbitrary.\n\nThe size of the experiment datasets are not stated (e.g. for style mimicry, the number of images per artist is given, but not the number of artists). The total number of samples evaluated should be given for both experiments.\n\nAdaptive protection results are shown only for style mimicry, not editing.\n\nThe authors do not appear to discuss the runtime / computational complexity of their purification method. \n\nIn apparent contradiction with the authors' response to the NeurIPS checklist, compute details appear to be missing from the paper and appendix.\n\nFor the experiments section, the image examples are currently more compelling than the metrics. For the image editing task, it is not clear from Table 2 how much \"better\" the purified images fare than protected images -- e.g., how significant is a PSNR value of 15 vs. 14? Is there a value below which an attempted edit can be considered a failure? Without context, it is hard to get a sense of the effectiveness of the proposed approach. The classifier metrics for the style mimicry experiment are clearer, but still do not take into account many aspects of generated image quality (e.g. adherence to the prompt beyond style). A human subjects study assessing the quality and \"correctness\" of images generated in each task for the clean/protected/purified conditions would be much more persuasive.\n\nThe evaluation tasks appear to involve image models that operate under different \"control\" paradigms -- fine-tuning and text-prompting in the case of style mimicry, and one-shot image-conditioning and text-prompting in the case of background editing. This difference seems significant in that in the former case, purification must mitigate the influence of protective perturbations on the training process while in the latter case, purification must only mitigate the influence of protective perturbations on a forward pass through the diffusion model. I think this distinction between experimental tasks should be emphasized because (a) it is not immediately clear in the paper, and (b) because it is possible this could be framed as a strength of the proposed method (i.e. operating in distinct tasks/settings).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "# Response to Reviewer EvE8\n\nThanks for the constructive comments!\n\n**Q1**:  Figures 1/4 are hard to read\n\n**A1**:  We are sorry for the confusion. Figures 1 and 4 showcase images generated by a model that was fine-tuned on either clean, protected, or purified images. We've detailed this in the captions of each figure. Displaying the input clean/protected/purified image alongside the edited versions is indeed a great idea. We will refine our paper based on your suggestion. \n\n**Q2**: Clarify the source of the task\n\n**A2**: We thank the reviewer for the suggestion. We will clarify in the experimental section of our paper that the task selection is based on the existing protection methods.\n\n**Q3**:  Number of evaluation samples \n\n**A3**:  We are sorry for the confusion. For the Style Mimicking task, we selected 8 artists and randomly extracted 24 pieces for fine-tuning the diffusion model and 100 pieces for validation, totaling 800 evaluation samples. For the Malicious Editing task, we selected 80 photos for testing, which amounts to 80 evaluation samples.\n\nIn response to Reviewer UShu's feedback, we have expanded the datasets for both the Style Mimicking and Malicious Editing tasks by 50%. For the Style Mimicking task, we've added artworks from 4 new artists, and for the Malicious Editing task, we've incorporated an additional 40 photos. Consequently, the total number of evaluation samples has increased to 1200 for the Style Mimicking task and 120 for the Malicious Editing task. The updated results are shown in Table 1,2 in the pdf. It can be observed that the results after data supplementation are largely consistent with the original results. Additionally, the sample size of our test set has already surpassed that in the original GLAZE paper (1,170 evaluation samples) and the original Photoguard paper (60 evaluation samples).\n\n**Q4**:  Adaptive protection results for Malicious editing.\n\n**A4**:  We apologize for any inconvenience caused. We added the results in Table 7 in the pdf . We found that the adaptive protection method brings degradation in protection performance when applied to the Malicious Editing task, and fails to resist the image sanitization by IMPRESS.\n\n**Q5**:  Discussion on Computational Complexity / time cost\n\n**A5**:  Please see **CA3** in our response to all reviewers.\n\n\n**Q6**: Significance of Metrics and Introduction of Human Subjects\n\n**A6**: We agree that assessing the significance of the metrics used in the Malicious Editing task is quite challenging. The current evaluation metrics basically follows what is done in PhotoGuard and we also think this is not perfect. Therefore, we presented numerous image results in the paper to visually illustrate the purification effects of our proposed method. We agree with you that the human subjects study may lead to more convincing results and we plan to add it later. Also upon public release of the paper, we will disclose all experimental codes and datasets used, including images purified by our method, to provide a clear demonstration of the effectiveness of our purification approach for the public.\n\n**Q7**:  Emphasizing the Distinctions of Our Method Among Different Paradigms\n\n**A7**:  Thank you for your suggestion! As you pointed out, the GLAZE method focuses on affecting the fine-tuning process of image generative models, while the Photoguard method targets the model's forward pass. We will highlight this in both the introduction and experimental sections of the paper.\n\n**Q8**: Current Protection Methods Utilize the Encoder-Decoder alone\n\n**A8**:  Both the GLAZE method and the encoder attack of Photoguard primarily exploit the encoder and decoder components of the latent space diffusion model, especially the encoder. However, Photoguard's diffusion attack backpropagates through the entire diffusion model. Note our consistency objective of the encoder-decoder is also sufficient to overcome Photoguard's diffusion attack, which suggests that the encoder-decoder part is probably the key to their attack. This is also reasonable since the diffusion part is essentially reconstructing the latent vector.\n\nWe believe that direct attacks on the diffusion process with imperceptible noise additions are challenging, as the continuous noise additions during the diffusion noising process would overwrite the subtle perturbations. \n\n**Q9**: Suggestion to use O-PGD \n\n**A9**: Thank you for the suggestion. We follow your advice and further tested the approach from Bryniarski et al. [2] within the adaptive method on the Style Mimicking task. The experimental results are shown in Table 3 in the pdf.\nWe found that the method of Bryniarski et al. did not bring significant improvement to the adaptive protection method. This might be due to the objective of our multi-loss not aligning perfectly with that of Bryniarski et al.. This suggests that the underlying principles of adversarial attacks on diffusion models might differ from those on classification models. This offers a fresh perspective on the issue. Thank you very much!\n"}]

Author rebuttal:
# Response to Common Question for All Reviewers
We thank all the reviewers for your valuable comments! 

**We have incorporated all experiments suggested by the reviewers:**

1. We've included a broader range of baseline methods, encompassing more potent traditional denoising techniques, combinations of various denoising methods, robust training strategies, and state-of-the-art denoising approaches. The results indicate that our method still outperforms others.
2. We've tested our approach on a more extensive dataset, and the results largely align with those presented in the paper.
3. We've augmented our experiments concerning adaptive defense techniques, which now include ablation studies on hyperparameters and stronger adaptive defense methods.
4. We've illustrated the purification effects across different JPEG compression quality factors.
5. We've added results for adaptive defense against Malicious Editing.

Besides, we have addressed all queries from the reviewers.

**Here we address some common questions for all reviewers:**

**CQ1:** Inefficacy of the adaptive protective method

**CA1:** We believe the suboptimal performance of the adaptive method is due to the following reasons:
1) The introduced supplementary loss term complicates the optimization of the loss function. For GLAZE method, the loss function of the adaptive method has three components. Optimizing three different loss components is typically challenging, and striking a balance among these components remains an intricate task.
2) The loss term employed for the adaptive method might clash with the inherent loss term of image protection techniques. The purpose of image protection technologies is to induce semantical differences between generated images and original ones. Our image purification approach aims to make the image maintains its semantic properties (consistency after reconstruction), potentially leading to underlying optimization conflicts.

To verify these issues, we've conducted two additional experiments:
1) We carefully tune the weight of the adaptive loss term. which is shown in Table 8 in the pdf.
We've adjusted the weight of the adaptive loss term over a broad spectrum, making it constitute approximately 10% to 95% of the total loss. We notice that when the proportion of the adaptive loss term is too minuscule within the entire loss, the experimental outcomes tend to resemble standard image protection technique results. Conversely, it considerably deteriorates the image protection performance. This suggests that achieving the balance of those three objective terms are hard.
2) As recommended by Reviewer EvE8, we further adopt Bryniarski et al.[1]'s Orthogonal Projected Gradient Descent approach to better balance competing objectives. The new results on GLAZE are shown in Table 3 in the pdf. We can observe that using O-PGD does not help much on the adaptive method.  

These results suggest that designing adaptive image protection techniques specifically for IMPRESS might inherently be challenging. 

**CQ2:** More baselines (e.g., CV denoising and robust training methods)

**CA2:** We thank for all the suggestions and added additional 4 types of baselines: 
1) traditional denoising method (e.g., low-pass filtering); 2) enhanced preprocessing approaches (resize+flipping+JPEG compression); 3) robust training methods (e.g., [2]); 4) advanced denoising approaches (e.g., Diffpure [5])
Table 4 and 5 show the experimental results for those additional baselines. For the Style Mimicking task, we have incorporated additional baselines, namely low-pass filtering, resize + flipping + JPEG compression, and the robust training method by Radiya-Dixit, E., et al. [2]. For the Malicious Editing task, we have added low-pass filtering, resize + flipping + JPEG compression, and Diffpure[5] as baselines. It can be observed that our approach still achieved the best results comparing with those additional baselines. Note that robust training method [2] is not tested on malicious editing task since it does not involve model fine-tuning. And Diffpure [5] is not tested on style mimicking task since it requires a pre-trained non-latent diffusion model on the target distribution (which is one of the major limitation of this method) but it is hard to find one on artist data currently.

**CQ3:** Computational Complexities

**CA3:**  Indeed JPEG and resizing operations take neglectable time to compute, however, as our results suggest, they are far more ineffective compared with our proposed method. Meanwhile, we notice the extra computations needed for our method is also not very significant. Under our experimental setup (stated in Appendix B of the paper), the purification of a single image took an average of 141 seconds. In comparison, GLAZE took an average of 90 seconds to compute adversarial noise for an image, while Photoguard required more than 600 seconds on average to perform the computations. In fact, due to the large size of the stable diffusion model, fine-tuning the model actually takes much longer time than optimizing those images, thus we believe the computational cost will not be a big issue here. 

We kindly request that you inform us of any remaining ambiguities or concerns. We are more than willing to address additional questions and conduct further experiments should the reviewers deem it necessary. 


[1] Gowal, S., et al. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.

[2] Radiya-dixit, E., et al. Data poisoning won’t save you from facial recognition. arXiv:2106.14851 (2021). 

[3] Gowal, S.,  et al. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34, 2021.

[4] Rebuffi, S.-A.,  et al. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946, 2021. 

[5] Nie, W, et al. "Diffusion models for adversarial purification." arXiv preprint arXiv:2205.07460 (2022).

Meta-review: This paper scrutinized existing data protection methods, casting doubt on their actual effectiveness. The observation made is that these existing methods exhibit a high degree of fragility, with some simple and direct approaches proving capable of successfully breaching them. It garnered feedback from five reviewers, all of whom commended the intriguing observation and findings. The rebuttal included many new experiments and effectively addressed most concerns.

The primary remaining concern centers around the technical simplicity of the proposed solution. The Area Chair acknowledges this concern but emphasizes that the key observation is exceptionally inspiring and offers valuable insights to the research community. Considering all factors, the Area Chair believes that the paper's overall strength outweighs its weaknesses and, as such, recommends acceptance. The authors should incorporate all the results and commitments from the rebuttal into the final version.
Decision: Accept (poster)