Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Models
Authors: Cong Wan
Yuhang He
Xiang Song
Yihong Gong
Venue: NeurIPS 2024 poster (2024)
Keywords: Adversarial perturbations
customized diffusion models
privacy protection
prompt distribution modeling
Primary area: diffusion_based_models
TL;DR: This paper proposes a Prompt-agnostic Adversarial Perturbation method for customized text-to-image diffusion models by modeling the prompt distribution and generating perturbations to maximize expected disturbance over sampled prompts.

Abstract: Diffusion models have revolutionized customized text-to-image generation, allowing for efficient synthesis of photos from personal data with textual descriptions. However, these advancements bring forth risks including privacy breaches and unauthorized replication of artworks. Previous researches primarily center around using “prompt-specific methods” to generate adversarial examples to protect personal images, yet the effectiveness of existing methods is hindered by constrained adaptability to different prompts.
In this paper, we introduce a Prompt-Agnostic Adversarial Perturbation (PAP) method for customized diffusion models. PAP first models the prompt distribution using a Laplace Approximation, and then produces prompt-agnostic perturbations by maximizing a disturbance expectation based on the modeled distribution.
This approach effectively tackles the prompt-agnostic attacks, leading to improved defense stability.
Extensive experiments in face privacy and artistic style protection, demonstrate the superior generalization of our method in comparison to existing techniques.

Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Models
Cong Wan Xi' an Jiaotong University wancongostu xiju. edu, cn
Yuhang He Xi' an Jiaotong University heyuhang@xjtu edu. en
Xiang Song
Yihong Gong
Xi'an an Jiaotong University
Xi an Jiaotong University ygongOmail. xjtu. edu. cn
songxiang@stu. xjtu. edu cn
Abstract
Diffusion models have revolutionized customized text-to-image generation, allow- ing for efficient synthesis of photos from personal data with textual descriptions. However, these advancements bring forth risks including privacy breaches and unauthorized replication artworks. Previous researches primarily center around using "prompt-specifie methods" to generate adversarial examples to protect per- sonal images, yet the effectiveness of cxisting methods is hindered by constrained adaptability different prompts. In this paper, introduce Prompt-Agnosti Adversarial Perturbation (PAP) method for customized diffusion models. PAP first models the prompt distribution using Laplace Approximation, and then produces prompt-agnostic perturbations by maximizing a disturbance expectation based on the modeled distribution. This approach effectively tackles the prompt- agnostic attacks, leading to improved defense stability. Extensive experiments face privacy and artistic style protection, demonstrate the superior generaliza- tion of PAP in comparison to existing techniques. Our code will be available at http://gghhub..co//aaacaaaaaaal
Introduction
Generative methods based on diffusion models 14 have made significant improvements recent years, enabling high quality text-to-image synthesis 61. image editing 77,, video generation [8] 9. and text-to-3D conversion [10] by prompt engineering. One the most representative methods in this field is the Stable Diffusion [2), which is large-scale text-to-image model. By incorporating customized techniques such as Text Inversion [3] and DreamBooth [14), Stable Diffusion only requires mie-tuning based on the input prompts.
few images accurately generate highly realistic and high-quality images
Despite this promising progress, the abuse of these powerful generative methods with wicked exploitation raises wide concerns [15), especially in portrait tampering [66-18] and copyright in- fringement [19]. For example, in Figure given several photos of a person, attackers can utilize diffusion models to generate fake images containing personal information, leading to reputation defamation. Even worse, attackers easily plagiarize unauthorized artworks using diffusion models, leading to copyright and profit issues. There is an urgent technology need to protect images from diffusion model tampering.
CCorresponding author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Prompt photo sks person: Prompt B: portrait persons
Protect Success
Fail
Prompt C: photo person cyberpunk city
Promptt
Prompt
defenne
Prompt
Diffusion Model
Promppt
Promept
(b) Prompt-specific perturbation
Input Image
A Pronpt
Prompt
Prompt
Prompt
Pronet Divbibbttion
(4) Prompt-agnostic perturbation
Figure/ 1: Illustration of portrait with (a) no defense, (b) prompt-specific and (c) our PAP prompt- agnostic perturbation. In (a), the portrait easily tampered with by the diffusion model. In (b), the prompt-specific methods only perform well on learned prompts (i.e., Prompt A) and are fruitless to unseen prompts (i.e., Prompts B and C). (c), the proposed PAP robust both the seen and unseen prompts, and successfully protects the portrait from diffusion model tampering
To this end, recent research studies delve into adding -iuaan-invisible adversarial perturbations onto
the images to prevent prompt-based tampering using diffusion models. The method Photoguard (20) maximizes the distance in the VAE latent space. Glaze (21] aims to hinder specific style mimicry,
while Botth 22 introduues
alternating training approach between the model and
adversarial examples. The AdvDM series [23 [4]. Adv-Diff (25) present theoretical frameworks and
improved methods for attacking LDM.
These methods follow a prompt-specific paradigm, wherein they need to pre-define and enumerate the possible prompts in training, and the test prompts required to be identical to the training ones. However, in real-world applications. once encountered with an unseen test prompt, their perturbations inevitably futile. As shown in Figure bb) the perturbation trained with Prompt A fails to protect the portrait on unseen Prompts B and C at inference.
To meet this challenge, we propose novel Prompt-Agnostic Adversarial Perturbation (PAP). Differ- ent from existing prompt-specific methods that require pre-defining and enumerating the attackers' prompts, PAP models the prompt distribution and generates prompt-agnostic perturbations by max- imizing a disturbance expectation based on the prompt distribution. Specifically, using a Laplace approximation, we derive the prompts distribution in text-image embedding feature space satisfying a Gaussian distribution, whose mean and variance can be estimated by the second-ord order Taylor expan- the Gaussian
sion and Hessian approximation with an input reference prompt. Then, by sampling prompt distribution and maximizing a disturbance expectation, we generate the PAP perturbations for the input images. As shown in Figure Cc., Fcc the PAP perturbation is trained using Ref Prompt, while robust to unseen Prompts B and C at inference. To verify the efficiency of our proposed method, we conduct comprehensive experiments Celeb-HQ and Wikiart. The experimental results show that the proposed PAP method 1) steadily and significantly outperforms existing prompt-specific perturbation on widely used metrics by large margin and 2) is robust and effective to different diffusion models, attacker prompts, and diverse datasets. These results demonstrate the efficiency and superiority of the proposed PAP method.
three widely used benchmark datasets, including VGGFace2,
In summary, our contributions are as follows:
We propose novel Homppt-Anostis Adversarial Perturbation (PAP) for customized text-to- image diffusion models. To the best of our knowledge, this is the first attempt at prompt- agnostic perturbation for customized diffusion models.
We model the prompt distribution as a Gaussian distribution with Laplace approximation, where the approximation error guaranteed. We then derive algorithms to estimate the mean and variance by Taylor expansion and Hessian approximation.

---

Based on the prompt distribution modeling, we compute the prompt-agnostic perturbations by maximizing a disturbance expectation via Monte Carlo sampling.
2
Related Work
Text-to-image generation models. Text-to-image generation has evolved from early cGANs and VQ-VAE [27] to advanced transformer-bit based models (28 DALL-E (34) and GLIDE 33
26
demonstrate breakthrough performance in diffusion models. Recent works like Textual Inversion 13.. DreamBooth [1), and ControlNet [6] further enhance generation quality through customization, user-specific fine-tuning, and additional control mechanisms.
Gradient-based adversarial attacks. Gradient- based adversarial attacks deceive machine learn- ing models through perturbed inputs. FGSM (36] maximizes loss function L(Jo(v + y) as:
ming -(D max, [( + 5), y). BIM 37 and PGD (38 enhance it through iterations. MI-
FGSM [39] adds momentum constraint, NI 40 employs Nesterov acceleration, EMI [41] stabilizes
with gradient averaging, and VMI
42 reduces variance via neighborhood tuning. CWA 43
addresses local optima through loss landscape analysis.
Prompt-specific image cloaking for generation. Early cloaking methods like Fawkes 44 Lowkey 45), and Deepfake defense [46] focus face recognition protection. For diffusion models, Photo- guard 20 maximizes VAE latent distance, Glaze [21 prevents style copying, and Anti-DreamBooth
22 employs alternating training. Recent works like UAP [47), AdvDM series 23 24 48 AdvTDM
49 AdvDiff (25), and Diffprotect [50] provide theoretical frameworks and improved methods for
attacking diffusion models.
In contrast, our work stands apart from these approaches by focusing on the predicted prompt distribution rather than predefined prompt instances, enabling to achieve global protection efficacy.
3
Prompt-Agnostic Adversarial Perturbation
3.1 Background and Motivation
Prompt-based Diffusion Models. A vanilla diffusion model 1 aims to gradually transfer a simple Gaussian noise into high-quality images through a series of denoising steps. It mainly contains a forward process (i.e., diffusion) and backward process (i.e., denoising). Begin with an image To, the forward process iteratively adds Gaussian noise ~ N(0, I) with noise scheduler 1 Ct, Ogp E 10,1)²= to the input image. The 1-step obtained noised image H, can be written as:
Et = Vario + VI ŌGE
where 0r -II Os.- When f. 00, 3e is Gaussian noise (i.e., 32 6). In the backward process, the objective is to learn a noise predictor c0( 1) predicting the added Gaussian noise at each step On this basis, taking Gaussian noise (i.e., [t - oo)) input, the diffusion model denoise the image 2a using ce(+), i.e., It-1 a, (z: 1-ay (z), t)) + 0 N(0. I), and iteratively generates a high-quality image 2g by denoising steps.
VI-a;
The prompt-based diffusion models 11 aim to generate a semantic guided image To from the Gaussian noise To this end, in the backward process, they additionally take text prompt the input of noise predictor e0( 6, c) alongside the Gaussian noise Tt, and align the image and text representation by cross-altention mechanism. The image generation objective of the prompt-based diffusion models can be written as:
min L Leond (zo, 0) Cec...o....Ko00...t.....0
where ((ro,ctt, =
= ||c co t, c)3..
Prompt-Specific Perturbation. By collecting set of characterized images (e.g., images of a certain person) and a custom-buil text prompt (e.g. "sks"), recent approaches such as DreamBooth [14] exploit prompt-based diffusion models for customized image generation. Despite their promising
progress, they raise concerns on content falsification such as portrait tampering and copyright infringement. To meet this challenge, existing diffusion-model perturbation methods [3] 22 attempt
3

---

to add an adversarial perturbation ó to the images, aiming to protect the characterized information of the images (such as a person's face) being falsified. Specifically, they often pre-define a custom text prompt co, and then optimize the adversarial perturbation ó to maximize the image generation loss function given co, which can be written as:
8" = arg max Foonddaa + co: c):
s.t.
p S 7)
where Leond evaluated according to 2q. By adding the obtained 8* 20, the diffusion models fail to generate high-quality images with the prompt co.
These methods, as we discussed in Section are insufficient when the text prompts are different from the training prompt. As shown in Figure (b), when obtaining a perturbation based on prompt A, the 8 failed to protect the image from being modified using different prompts such B and C. These methods compute the perturbations based on enumerated text prompt instances, Le., prompt-specific perturbation, are fruitless facing with endless attack prompts real-world applications.
3.2 PAP: Prompt-Agnostic Perturbation by Prompt Distribution Modeling
Different from the existing methods that compute a prompt-specific perturbation by enumerating prompt instances, we attempt to compute prompt-agnostic perturbation by prompt distribution modeling, wherein the obtained perturbation robust to both seen and unseen attack prompts.
We choose the Laplace approximation as our estimator for three key reasons: 1) it typically yields Gaussian distribution suitable for large sample sizes; 2) it simplifies computations compared to complex methods like Monte Carlo simulations, particularly when analytical forms are difficult to obtain; and 3) it aligns well with our ideal prompt embedding distribution, concentrated around extreme points.
To this end, first model and compute prompt distribution by Laplace approximation, wherein two estimators & and v are developed to compute the distribution parameters. And then we perform Monte Carlo sampling on each input distribution maximize disturbance expectation.
Specifically, for the prompt distribution modeling, we consider a protecting image Zo as input and assume
correlation between the attacker prompt and 2o, i.e., the further is from To. the lower probability of e is the distribution, and vice versa. The distribution relies on xo is ambiguous, thus introduce auxiliary text prompt co roughly depicting To into the modeling. Based on this foundation, we model the prompt distribution in the embedding space as c E Q (mooroa) where Q (za,no) represents the theoretical distribution with a probability density function p(c|zo, Co).
Based on this setup, we approximate the original distribution Q(mo.eo) using a Gaussian distri- bution (z by Laplace approximation, i.e., c ((100-r)) NN(c, H where Cp arg max, p(c[2r, en), and H is the Hessian matrix of Cs. As derived in Section 3.3.1 the approximation error is O(Ic - c2)3), which is negligible as the sampled c E ( is close to Cr-
On this basis, we propose two estimators ó and & used to estimate e₂ and H-1 respectively. For 6, to compute C₂ arg max. p(c]ao, co) that best describe Fo, we approximate é ó(Io. e) by minimizing the generation loss in Eq. ( with momentum iterations starting from co. This approach accelerates convergence and avoids getting trapped in local minima. For q), we approximate H-1 = v0(z e, Co. f) by performing a Taylor expansion around the flattened é and incorporating prior information from cp. Appendixes An2 and H-1 are with explicit upper bounds, and more detailed descriptions are provided in Section 3.3.2
AApendixes/A.2andd] A.3 we have proven that the estimation errors c,
Then, we compute the prompt-agnosio adversarial perturbation 8 by maximizing the expectation of Loond in (2 over the prompt distribution Q(so..o)- The objective can be formulated as:
8 = arg max Ee-Q (op) Lzo + c.:o:))
à
/
= arg max
p(c|co, 0o) Iecona(To + 8, co; f)de, s.t. |8 S
where p(c|zo, co) is used to represent the probability distribution of Q (()) given the inputs

---

To optimize Eq. 4 from a global perspective, we devise strategy in Section 3.4 that utilizes Monte Carlo sampling on all input distributions, including @ (ma.co)) to maximize the disturbance expectation.
3.3 Modeling the Prompt Distribution Q (=a:
In this subsection, we first approximate the form of (za,co) and then estimate its mean and variance.
3.3.1 Laplace Modeling
Definition 3.1. Since xo and co are independent of c, we consider = p(ao, Co) as a constant. De- := arg max. g(c), and H := VV log gc))le, for convenience.
note g(c) == p(zo. colc) p(c), :=
We adopt Laplace approximation to model (zzo.o)) Using Bayes" theorem, we obtain:
p(c|zo, co) p(zo, colc) p(c)
(5)
p(ro, co)
We then approximate log g(c) in Definition 3.1 around c. using second-order Taylor expansion:
log g()) log ((<)) - 2( cx) Hx ex)².
From (6) and by ignoring terms that are independent of we infer that
p(c/zo,co co) x exp --gle-c.)((ccc))
(7)
which means p(c|ar, co) could be approximated
normal distribution, i.e.,
Q (a) (c) ~ NN(c,, H-
(8)
The derivation is provided in Appendix A.I wherein the error of the Gaussian approximation the third-order derivatives of log p(z) around Ca. i.e., O(le - cx 1s).
A.
3.3.2 Parameter Estimators
Estimator d. According Definition 3.1 Cp is defined as the text feature that maximizes the joint probability of In and co. As directly maximizing the likelihood is untrackable, similar to [51], we convert the likelihood maximization problem into expectation minimization problem with proper approximation (please kindly refer to Appendix A.2 for more details), which can be written as:
& (b arg min Laro e, () arg min Σ - (are c)
t=
To solve for è in Eq and avoid local minimal, we derive a momentum-based iterative method 39 with the initial value set as the reference prompt co:
m4 3m (1 (x,,,,,,
(10)
= C m4
where m, represents the momentum term iteration i, and are learning rates.
Estimator db To compute in Definition 3.1
we adopt three operations: substituting - log g(c)
with the loss function L in Eq. incorporating prior information from co. and applying the Taylor approximation of L around the flattened è (Detailed in Appendix A.3. which enable us to compute:
(co To obtain -1 from Eq. 11 we simplify the effective dimensionality of H/ in Appendix A.3.2 allows us to estimate the using the following expression:
(co - c²) 2 (L(z, e, co: 0) L(x, e, Cz; 6)),
(11)
This
l|co
ér 2
n w1 f, co. 2 (L(x, 6,
(12)
4, co; 0) L(x, C, L,;
where I represents the identity matrix and x are input images. As we analyzed in Appendix A.3.2 the cosine distance between the approximated f- and H-1 (diagonalized assumption) is with an upper bound of 0.0909 under our standard experimental settings. This simplification significantly reduces the computational complexity with minor approximation error.
5

---

Algorithm Prompt-Agnosicc Adversarial Perturbation
Input: images æ; reference prompt c, parameter 0, epoch numbers M, N, learning rates a, r, S
budget 7,, noise steps T, loss function L(x, C, c,,,;;8 0) in Eq.
Output: Adversarial examples IM
Initialize co = C, 40 σ, m00 = 0, 6a ~ N(O,
for jo = to N do
Sample le & 7),
Compute gradient 9. = Ve, (,,,, Ect te. Cy:
Compute momentum m1+1 8m; + (1 3)9c
Update C5+1 = - m, end for
for i- 0 to M - do
Sample e N(O, /), E (O,
Sample ~ N(eN, 2-(L(
1100 (2..edev1
Compute gradient Is Va, [Ti (1,00)
Update Fi+1 = clip z0.1 .) (zi sgn(
end for
3.4 Maximizing the disturbance expectation
In this subsection, we devise the strategy of maximizing the disturbance expectation based on the modeled prompt distribution, thereby obtaining the final PAP algorithm outlined in Algorithm |
Sampling Distributions for maximization. To maximize the optimization objective Eq. (4) from global perspective, we adopt Monte Carlo sampling on all input distributions, including (zo.co))
Drawing inspiration from established adversarial attack methods 223 36 52], we iteratively sample values for i, c, and 6.. Subsequently, we perform gradient ascent step L C,t, f) with respect to xr which can be summarized as:
Ii+1 = D2 + a sgn( Len(V,LL(z,,, e, t, c; ~ N I), (O, Q (s).ra)))
(13)
where sgn()) refers to the sign function, and a controls the step size of the gradient ascent.
Further Discussion. To further enhance the effectiveness of our proposed algorithm, we seamlessly
integrate with other techniques in Appendix C such as ASPL [22], to reach a better performance. We also discuss modifying the perturbation space with the tanh function for smoother optimization
with better flexibility [52] than clipping- based constraints in Appendix Lastly, AppendixxFleeplores
the limitations and future directions of our model.
4 Experiments
In this section, we experimentally compare PAP with other protection methods for customized models, specifically targeting DreamBooth, the leading customized text-to-image diffusion model for personalized image synthesis. DreamBooth customizes models by reconstructing images using a generic prompt that includes pseudo-words like "sks." " while also addressing overfitting and shifting through a prior preservation loss. We evaluate PAP on various tasks, including privacy and style protection, using diverse datasets.
4.1 Experimental setup
Datasets. Our experiments involve face generation tasks using CelebA-HQ 53 and VGGFace2 [54] datasets, well as style imitation task using the Wikiart dataset [55] For CelebA-HQ and VGGFace2, we select subsets of 600 images respectively, with each of 12 photos from an identical individual. For Wikiart, we choose 100 paintings, with each set consisting of 20 paintings from the same artist
Implementation Details. We optimize adversarial perturbations over 50 training steps and 20 text sampling steps. The step size of image, text and momentum set to 1/255 and 0.001, 0.5 respectively, and the default noise budget 0.05. For the Dreambooth, LoRA ,II models, we train the models

---

with learning rate of 5 x 10-7 and batch size 4. We perform 1,000 iterations of fine-tuning with SD1.5 as a pretrained model. The PAP method takes approximately an NVIDIA A800 GPU with 80GB memory. To assess defense robustness, we simulate diverse attacker prompts using ten inference sentences Table that cover wide range of possibilities. All experimental results presented below are based on the average metrics obtained from ten sentences at default. This approach provides a comprehensive evaluation overall protection capability with smoother metric variations.
minutes complete on
Evaluation Metrics. We utilize six metrics, categorized into three aspects. For more detailed introduction, please refer to Appendix E.4
1) Image-to-Image Similarity: We adopt the following metrics assess image similarity: CLIP taage-to-Image Similarity (CLIP-I) [56]. Fréchet Inception Distance (FID), and Learned Perceptual Image Patch Similarity (LPIPS) [57] Lower CLIP-I (U) and LPIPS (L),
and higher FID (1) indicate better defense performance;
2) Text-to-Image Similarity: CLIP measures the coherence between the test prompt and generated images, with lower scores (1) indicating worse alignment;
3) Image Quality: BRISQUE (58) evaluates image quality using statistical features, with higher scores (1) indicating worse quality. LAION aesthetic predictor [59] assesses the aesthetic quality of images based on visual features, with lower scores (L) indicating worse aesthetics.
Table I: Comparison with other adversarial perturbation methods on the face generation task (includ- ing Celeb-HQ and VGGFace2 datasets, training prompt "a photo of sks person") and style imitation task (including Wikiart dataset, training prompt "a sks painting") using ten different test prompts, where the reported metric values are the average across these ten test prompts.
Dataset
Method
FID (1)
CLIP-1
LPIPS (t)
LAION (L)
BRISQUE (f)
CLIP
Clean
124.2
0,7844
0.4776
6.082
28.12
0.3368
AdvDM
217.1
0.6728
0.5682
5.721
34.19
0,2905
Celeb-HQ
Anti-DB
233.3
0.6371
0.5924
5.497
35.89
0,2800
IAdvDM
159.1
0.6955
0.5303
5.768
31.77
0,2699
PAP(Ours)
0.5539
0.6730
5.280
230.3
0.6567
0.5471
5.889
25.67
AdvDM
243.8
0,5931
0.6775
5,551
31.41
0.2823
VGGFace22
Anti-DB
273.0
0,5483
1.6960
5,334
28.95
0.2766
IAdvDM
248.6
0,5802
0.6798
5.597
32.93
0,2835
PAP(Ours)
288.5
0.5164
0.7023
5.127
35.02
0,2577
Clean
198.7
0.7715
0.6193
6.367
27
0.3515
AdvDM
392.7
0.6498
0.7606
5.949
33.5
0,3026
Wikiart
Anti-DB
386.4
0.6462
0.7396
5.715
31.01
0.2997
IAdvDM
390.0
0.6550
0.7149
5.996
0.3037
PAP(OUrr)
448.3
0.5641
0.7782
5,490
38.47
0.2654
4.2
Comparison with State-of-the-Art Methods
4.2.1 Face Privacy Protection
We first conduct experiments in preserving face privacy. During training, the reference and training prompt are both set as "a photo of sks person". Then we use ten prompts related to sks person evaluate the models' ability synthesize images. The average results are presented in Table T showcasing the superior performance of our method in terms of all metrics on both the CelebA HQ and VGGFace2 datasets. For example, on the Celeb-HQ dataset, our method exceeds the second-best Anti-DB by 13.55% % in LPIPS, and reduces by 13.06% % and 3.948 % in CLIP-I and LAION. Also, on the VGGFace2 dataset, our method exceeds the second-best method by 6.347 in BRISQUE, and reduces by 5.818% and 6.833% % in CL.P-I and CLIP. These results highlight the effectiveness of our method in preserving face privacy as well as robustness to datasets and various prompts' attacks. In Figure 2 (left), we visualize some of the comparative protection results.

---

VGGFace2
Wikiart
Clean
AdvDM
Ant-DB
1AdvDM
PAP (Ours)
aboto sks
dele sks person.
an Imprssionistic depictin sks petson.
a cyberpunk reprssataioon das person.
paintigg pounting
a photo dog a photo of
sks pointing
Prompt:
of pirson.
skss pointing
person story right. painting
Figure 2: Qualitative defense results of differrnt methods in VGGFace2 (left) and Wikiart (right). Each row represents a method, and each column represents different test prompt (shown at the bottom). The adversarial examples generated by our method effectively defend against all prompts in both datasets. In contrast, other baselines primarily focus on protecting the fixed prompt (the first column), resulting in compromised defense for other prompts.
Table 2: Ablation study of text sampling steps.
Text sampling stops
FID (?)
CLIP-1
LPIPS (f)
LAION (1)
BRISQUE (?)
CLIP (1)
Cycle Time
386.4
0.6462
0.739
5.715
31.01
0.2999
0.3s
10
430.8
0.5873
0.7665
5.577
36.24
0.2710
5.0k
0.7782
0.2654
7.4s
20
457.5
0.5562
0.7854
5.466
38.33
0.2591
9.6s
462.8
0,5481
0.7901
5.508
38.37
0.2552
11.95
4.2.2
Style Imitation
We also evaluate methods' ability to prevent artistic style imitation using the Wikiart dataset. The reference and training prompt are both set as "a sks painting". Ten prompts related the style of "sks" painting are used to evaluate the model's 's performance and robustness. It is observed in Table that our method achieves higher FID, LPIPS, BRISQUE and lower CLIP-I, LAION and CLIP compared to existing methods. For instance, the FID and BRISQUE of our method outperforms that of others by at least 14.16% and 8.980% while the CLIP-I and LAION reduce by least 12.71 % and 3.94% % These results demonstrate the effectiveness of our method in preventing style imitation as well as robustness attacks with different prompts. In Figure X the comparative protection results for Wikiart dataset. More visualized results are demonstrated in Appendix
(right), we visualize some of
4.3 Ablation Study
Text Sampling Steps. We evaluate PAP under different text sampling steps N (ranging from 0 to 25) used for sampling the prompt e during training. We use the Wikiart dataset and "a sks painting" prompt to conduct this ablation experiment (see Table 2}. Taking into account the cycle time and model performance, we set the text sampling step to 15.
Inference Prompt Combination. To analyze the effect of prompt variation, we design combinations of prompt categories and quantity: 2020, 8x 8x10, 10x8, 16x5, 20x4. This keeps the total number of generated images constant while varying the number of prompt categories, allowing us to isolate the effect of prompt categories on the results. Figure shows, PAP consistently surpasses all other comparison methods and maintains robust defense against changes in prompt categories.

---

Sensitivity to the Initial Prompt. In Table we present the outcomes when using the initial prompt "", showcasing sigmificant decline in performance compared to the original PAP. This decline is attributed to: a) the initial prompt serves as a crucial prior for estimating parameters, facilitating rapid iteration (only 20 steps) achieve a reliable approximation; b) it is involved in the modeling of H estimation, where the approximate expression for H is based on the Taylor expansion modeling of the relevant parameters.
Table 3: Results with the initial prompt
Dataset Celeb-HQ
FID (L)
CLIP-I (t)
LPIPS (1)
LAION (L)
BRISQUE (t)
CLIP (1)
154.57
0.72
0.50
5.83
30.18
0.32
VGGFace2
232.34
0.61
0.60
5.65
29.20
0.29
Wikiart 320.79
0.69
0.71
5.72
31.88
0.30
Pseudo-word. In experiments, conduct evaluations using the commonly used pscudo-word "sks," which is representative but may not cover all possible cases. To further validate our method, we included additional less commonly used pseudo-words. Results in Table 12 clearly demonstrates that our method consistently outperforms the others with other pseudo-word.
Evaluate the approximating H. We conduct a simple experiment by directly adding Gaussian noise (with variances 1, 5, 10, and 20) the input to evaluate the value of approximating H. As shown in Table our proposed PAP method, using the variance estimate o², achieves the best performance across all metrics. Specifically, it outperforms the second-best method by 3% (LPIPS), 2% (FDFR), 3% (ISM), and 2.27% (BRISQUE). These findings underscore the necessity of estimating variance r² to generate more effective adversarial perturbations.
Table 4: Simple Baseline of Adding Gaussian Noise the Input VGGFace2 Dataset
Variance
LPIPS (4)
FDFR (1)
ISM (1)
BRISQUE (t)
0.67
0.64
0.38
31.92
0.67
0.65
0.38
32.75
10
0.66
0.62
0.40
29.21
20
0.64
0.60
0.44
27.01
H
0.70
0.67
0.34
35.02
Other Customized Models. To verifyy the robustness of proposed methods to fine-tuning methods, we apply PAP to Textual Inversion and DrethBooth with LoRA. LoRA [60], widely used efficient low-rank personalization method, poses concerns due its strong few-shot capability that enables unauthorized artistic style copying. Textual Inversion [3] learns customized concepts by simply optimizing a word vector instead of finetuning the full model. Table Rebbensrdmoostrattt that PAP effec- tively defends against both methods, highlighting our efficacy in countering various personalization techniques.
Noise Budget. We conduct experiments to explore the impact of noise budget 77 on PAP's defense performance (see Table II in Appendix F.4). A noise budget of 0.05 is effective and adopted.
SARION
201
130
(LD-1
LOLAA ())
SSUSQUZ
CLIP
Figure 3: Defense performance of different methods in prompt variation settings. The x-axis
represents the number of prompt categories multiplied by the number generated images per prompt: 4 x 20, 8x 10, 10x8, 16x5, and 20x4. The y-axis displays the values of different metrics.

---

Table 5: Robustness of our method to different fine-tuning models.
Hl)
(LIP-
LPIPS (t)
LAION
BRISQUE
CLIP
LoRA
152.5
0.7544
0.5929
6.227
18.25
0.4379
LORA
375.8
0.6271
0.7673
5.534
41.16
0.2440
13.21
T1
281.8
0.6605
0.7220
5.588
38.94
0.2462
4.4 Extending Experiments
DiffPure. DiffPure [6]] utilizes SDEdit 62 purify adversarial images by adding noise and denoising them using diffusion models. In Table 6 we conduct experiments on the Wikiart dataset using DiffPure (t=100). We can see that, 1) compared to No Defense, PAP+DiffPure achieves much better adversarial perturbation performance (0.565(L), 3.38(1), 0.0408(L) advances on LAION, BROSQUE and CLIP metrics). 2) Compared to other methods+Difflure, PAP+DiffPur still achieves the best performance on all metrics.
Table 6: Performance comparison after applying DiffPure with changes in ()
FID
CLIP-T()
LPIPS
LAION (J)
BRISQUE (f)
CLIP
AdrDM-DinPPre
301 (99.42(91488-)
0.71(0.06+)
0.70:0.06-)
6.217(0.284))
28.58(4.96-)
0.3376(0.0550+)
335.94(50.46-)
0.69(0.04))
0.6800.6-))
5.991(0.276+)
30.12(0.89.)
0.341000.04134)
IAd-DM-DirPPn
271.02(1 18.98-)
0.72(0.01+)
0.68(0.03.)
6.227(0.23+
28.00(7.30-)
0.3489(0.045--)
PAP+DillPur
379.60(68.70-)
0.64(0.08+)
0.72/0.06-)
5.802(0.3124)
30.72(7.75-)
0.3107(0.0453+)
No Defense
198.71
0.77
0.62
27.34
0.3515
Preprocessing. A recent study (63] reveals that current data protections in text-to-image models are fragile and demonstrate limited robustness against data transformations like JPEG compression. To assess the resilience of our proposed Prompt-Agnost conduct targeted evaluations using the LAION and BRISQUE metrics. Despite slight decrease in performance, our method still achieves favorable outcomes in terms of image quality metrics For detailed discussion and results, please see Appendix F.6
Adversarial Perturbation (PAP) method, we
Conclusion
This work mitigates risks from misusing customized text-to-image diffusion models. We introduce subtle perturbations optimized from modeled prompt distribution, fooling such models for any prompt. Demonstrating resilience against diverse attacks, our framework surpasses prior prompt- specific defenses through robustness gains. By efficiently perturbing content via distribution-awan method, our contributions effectively safeguard images from diffusion model tampering under unknown prompts.
Acknowledgements
This work funded by the NSFC under Grant No. U21B2048 and No.62302389 and Shenzhen Key Technical Projects under Grant CJGJZID2022551 41660001, China Postdoctoral Science Foundation No. No.2024M772284, the Fundamental Research Funds for the Central Universities No.xzy01 20044077.
10

---

References
[1] Jascha Sohl-Dickstein,, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics, In International conference machine learning, pages 2256-2265. PMLR, 2015.
[2] Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
[3] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
[4] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011. 3356,, 2020.
[5] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
[6] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3836-3847, 2023.
[7] Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. Imagic: Text-based real image editing with diffusion models. In Proceedings of the IEEESCVF Conference on Computer Vision and Pattern Recognition, pages 6007-6017, 2023.
[8] Ruihan Yang, Prakhar Srivastava, and Stephan Mandt. Diffusion probabilistic modeling for video generation. Entropy, 25(10):1469, 2023.
(9] Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Do- minik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:231..1512) 2023.
[10] Ben Poole, Ajay Jain, Jonathan T Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. arXiv preprini arXiv:2209. 14988, 2022.
[11] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-1069) 2022.
[12] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952 2023.
[13] Rinon Gal, Yuval Alaluf, Yuval Atzmon, Or Patashnik, Amit H Bermano, Gal Chechik, and Daniel Cohen-Or. An image is worth one word: Personalizing text-to-image generation using textual inversion. arXiv preprint ar arXivv2208.0161
2022.
[14] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driver generation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 22500-222 10, 2023.
[15] Chuan Chen, Zhenpeng Wu, Yanyi Lai, Wenlin Ou, Tianchi Liao, and Zibin Zheng. Challenges and remedies to privacy and security in aige: Exploring the potential of privacy computing, blockchain, and beyond. arXiv preprint arXiv:2306.00419 2023.
[16] Tao Wang, Yushu Zhang, Shuren Qi, Ruoyu Zhao, Zhihua Xia, and Jian Weng. Security and privacy generative data in aige: A survey, arXiv preprint arXiv:2309.0990
2023.
[17] Xiangyang Luo, Xin Zhang, Yifan Xie, Xinyi Tong, Weijiang Yu, Heng Chang, Fei Ma, and Fei Richard Yu. Codeswap: Symmetrically face swapping based on prior codebook, ACM Multimedia 2024, 2024.

---

[18] Haiwei Xue, Xiangyang Luo, Zhanghao Hu, Xin Zhang, Xunzhi Xiang, Yuqin Dai, Jianzhuang Liu, Zhensong Zhang. Minglei Li, Jian Yang, al. Human motion video generation: A survey. Authorea Preprints, 2024.
[19] Mingyuan Fan, Cen Chen, Chengyu Wang, and Jun Huang. On the trustworthiness landscape of state-of-the-art generative models: comprehensive survey. arXiv preprint arXiv:2307 16680, 2023.
[20] Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai ai-powered image editing. arXiv preprint arXiv:2302.06588, 2023.
[21] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. arXiv preprini arXiv:2302.04222, 2023.
[22] Thanh Van Lc, Hao Phung, Thuan Hoang Nguyen, Quan Dao. Ngoc N Tran, and Anh Tran. Anti-dreambooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116-2127, 2023.
[23] Chumeng Liang. Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma. and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Machine Learning, pages 20763-20786. PMLR, 2023.
[24] Boyang Zheng, Chumeng Liang, Xiaoyu Wu, and Yan Liu. Understanding and improving adversarial attacks on latent diffusion model. arXiv preprint arXiv:2310.0066872000 2023.
[25] Decheng Liu, Xijum Wang, Chunlei Peng, Nannan Wang, Ruiming Hu, and Xinbo Gao. Adv- diffusion: Imperceptible adversarial face identity attack via latent diffusion model. arXiv preprint 2.t.:2332.1128855 2023.
[26] Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. arXiv preprint arXiv: 1784, 2014.
[27] Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems, 30, 2017.
[28] Xing Wei, Yifan Bai, Yongchao Zheng, Dahu Shi, and Yihong Gong. Autoregressive visual tracking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9697-9706, 2023.
[29] Yifan Bai, Zeyang Zhao, Yihong Gong, and Xing Wei. Artrackv2: Prompting autoregressive tracker where to look and how to describe. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 19048-19057, 2024.
[30] Xinyuan Gao, Songlin Dong, Yuhang He, Qiang Wang, and Yihong Gong. Beyond prompt learning: Continual adapter for efficient rehearsal-fre continual learning. arXiv preprint arXiv:2407.10281, 2024.
[31] Qiang Wang, Yuhang He, Songlin Dong, Xinyuan Gao, Shaokun Wang, and Yihong Gong. Non-exemplar domain incremental learning via cross-domain concept integration. In European Conference on Computer Vision, pages 144-162. Springer, 2025.
[32] Zeyang Zhao, Qilong Xue, Yuhang He, Yifan Bai, Xing Wei, and Yihong Gong. Project- ing points to axes: Oriented object detection via point-axis representation. arXiv preprint arXiv:2407.08488 2024.
[33] Lin Peng, Yuhang He, Shaokun Wang, Xiang Song, Songlin Dong, Xing Wei, and Yihong Gong, Global self-sustaining and local inheritance for source-free unsupervised domain adaptation. Pattern Recognition, page 110679, 2024.
[34] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical cext-conditional image generation with clip latents. arXiv preprint MXXi:22204.06222 1(2):3 2022.
12

---

[35] Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Hya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprini arXiv:21 10741, 2021.
[36] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412..572, 2014.
[37] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 99-112. Chapman and Hall/CRC, 2018.
[38] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint wxXiv:/7060066 2017.
[39] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185-9193, 2018.
[40] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint (eXiv:/908.06220 2019.
[41] Xiaosen Wang, Jiadong Lin, Han Hu, Jingdong Wang, and Kun He. Boosting adversarial transferability through enhanced momentum. arXiv preprint arXiv:2103.10609 2021.
[42] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 1924-1933. 2021.
[43] Huanran Chen, Yichi Zhang, Yinpeng Dong, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. arXiv preprint 2rXiv:2303.09105, 2023.
[44] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX security symposium (USENIX Security 20), pages 1589-1604, 2020.
[45] Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint 10X.:2200107900 2021.
[46] Chaofei Yang, Leah Ding, Yiran Chen, and Hai Li. Defending against gan-based deepfake attacks via transformation-awaan adversarial faces. In 2021 international joint conference neural networks (IJCNN), pages 1-8. IEBE, 2021.
[47] Zhengyue Zhao, Jinhao Duan, Xing Hu, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Yunji Chen. Unlearnable examples for diffusion models: Protect data from unauthorized exploitation. arXiv preprint arXiv:2306.01902, 2023.
[48] Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protec- tion against diffusion-basee mimicry through score distillation. In The Twelfth International Conference Learning Representations, 2023.
[49] Junxi Chen, Junhao Dong, and Xiaohua Xie. Exploring adversarial attacks against latent diffu- sion model from the perspective of adversarial transferability. arXiv preprint arXiv:2401.070 2024.
[50] Jiang Liu, Chun Pong Lau, and Rama Chellappa. Diffprotect: Generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint 2rXiv:2305.13625 2023.
[51] Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu. Robust classification via a single diffusion model. arXiv preprint arXiv:2305.152 15241, 2023.
[52] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 ieee symposium security and privacy (sp). pages 39-57. Icee, 2017.
13

---

[53] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. arXiv preprint arXiv:1710.1019,, 2017.
[54] Jianbo Chen, Michael I Jordan, and Martin Wainwright. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium on security and privacy (sp), pages 1277-1294. IEEE, 2020.
[55] Babak Saleh and Ahmed Elgammal. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.000 150500085, 2015.
[56] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation metric for image captioning. arXiv preprint arXiv:2104.085 08718, 18, 2021.
[57] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features as perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586-595, 2018.
[58] Anish Mittal, Anush Krishna Moorthy, and Alan Conrad Bovik. No-reference image quality assessment in the spatial domain. IEEE Transactions on image processing, 21((2):4695
2012.
[59]
2022.
[60] Edward Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang. Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.0990 2021.
[61] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.0744 2022.
[62] Chenlin Meng. Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun- Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint arXiv:2 2021.
[63] Yixin Liu, Chenrui Fan, Yutong Dai, Xun Chen, Pan Zhou, and Lichao Sun. Toward robust imperceptible perturbation against unauthorized text-to-image diffusion- based synthesis. arXiv preprint arXiv:2311.13127, 3, 2023.
[64] Fan Yin, Zhouxing Shi, Cho-Jui Hsich, and Kai-Wei Chang. On the sensitivity and stability of model interpretations in nlp. arXiv preprint arXiv:2104.0877 2021.
[65] Vikas Raunak, Vivek Gupta, and Florian Metze. Effective dimensionality reduction for word em- heddings. In Proceedings of the 4th Workshop on Representation Learning for NLP (RepLANI.P. 2019), pages 235-243, 2019.
[66] James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Baabbsk-Barwinska.. et al. Overcoming catastrophic forgetting in neural networks. Proceedings of the national academy of sciences, 1 114(13):351133522 2017.
[67] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. arXiv preprint 161v:2661.002770, 2016.
[68] Sarah K Amer Ai imagery and the overton window. arXiv preprint arXiv:2306.0000 2023.
[69] Amelia Katirai, Noa Garcia, Kazuki lde, Yuta Nakashima, and Atsuo Kishimoto. Situating the social issues of image generation models in the model life cycle: sociotechnical approach. arXiv preprint arXiv:2311. 1.v:23/1118844 2023.
[70] Zhengyue Zhao, Jinhao Duan, Kaidi Xu, Chenan Wang, Rui Zhangp Zidong Dup Qi Guo, and Xing Hu. Can protective perturbation safeguard personal data from being exploited by stable diffusion? arXiv preprint arXiv:2312.0000 2023.
14

---

[71] Tianrui Qin, Xitong Gao, Juanjuan Zhao, and Kejiang Ye. Destruction-restoratioo suppresses data protection perturbations against diffusion models. In 2023 IEEE 35th International Conference Tools with Artificial Intelligence (ICTAI), pages 586-594. IEEE, 2023.
[72] Ruijia Wu, Yuhang Wang, Huafeng Shi, Zhipeng Yu, Yichao Wu, and Ding Liang. Towards prompt-robust face privacy protection via adversarial decoupling augmentation framework. arXiv preprint arXhv:2305.03980, 2023.
15

---

A Derivation of Prompt Distribution Modeling
In this section, our goal is develop an algorithm for modeling the prompt distribution given reference prompt and protecting images Tu- Since the exact form of this distribution is impractical to derive, we employ the idea of Laplace approximation. By considering a second-order Taylor expansion at critical point, we approximate the distribution near this critical point as a Gaussian distribution. To reduce computational complexity, we make assumptions and approximate estimates for the mean and variance. The algorithm is presented in Algorithm 2
Algorithm 2 Prompt Distribution Modeling
Input: images reference prompt parameter 8, epoch numbers N, learning rates 3, noise loss function [[x, e, f, o; 0) in Eq. (2).
Output: Mean CN, square H-1
Initialize: cy = C, 20 I, mo =
for to N 1 do
Sample /
Compute gradient 9. Ve, L,,,,,,,
Compute momentum mj+1 Bmy + (1 3)ge
Update C5+1 g end for Compute A -
In the following, we will provide mathematical justificattin for the algorithm's validity,
A.1
Laplace Approximation Details
A.1.1 Motivation and Basic Idea
Laplace approximation is simple yet widely used method for approximating probability distributions, especially in the context of Bayesian inference and machine learning. The main idea behind Laplace approximation is to approximate a target distribution p(z) by a Gaussian distribution (M, E), where the mean f and covariance Σ are determined by matching the extreme point and curvature of the target distribution at its extreme point.
Specifically, let be the maximum point of p(x), i.e., C2 = arg max, p(z). Laplace approximation uses second-order Taylor expansion log p(x) around ea to construct the approximate Gaussian distribution:
1 logp(x) so logp(c.) 5 c.) +0 ca * 13),
(14)
where H(c,) is the Hessian matrix (the matrix of second-order partial derivatives) of log p(æ) evaluated at cze Exponentiating both sides and ignoring the higher-order terms, we obtain the Laplace approximation:
p(x) N(cc, Hc(
(15)
A.1.2 Error Analysis
The error of the Laplace approximation comes from neglecting the higher-order terms in the Taylor expansion. The approximation can be quantified by the remainder term O[ cz13)), which represents the third and higher-order derivatives of log p(r) evaluated at some point between x and Cz.
More precisely, let (xx) denote the remainder term, then the Laplace approximation can be written as:
p(x) NN(c, - (H(c)) exp(E(x)).
(16)
16

---

where {(x) satisfies lim -n (())/= 0. This means that the relative error of the Laplace
approximation is [ Ca ") in neighborhood of cz.
In general, the accuracy of the Laplace approximation depends on the smoothness and behavior of the target distribution p(z) around its mode cz. p(x) is sufficiently smooth and concentrated around Oz. the higher-order terms in the Taylor expansion become negligible, and the Laplace approximation provides good approximation. However, if p(z) has heavy tails or is modti, the approximation error can be significant, especially regions far away from Cp.
A.2 Estimation of Oz
From Definition
3.1 and derivations AdvDM 23 we have:
log (()) p(c) + log colc)
(17)
log + [oloop((t-1le,,z))
where xı is defined in Eq.[]
Since minimizing the diffusion loss to maximize likelihood common practice, we have:
Cp = arg max pmlo
(18)
arg min E, (100 Loondlro + 0).
To reduce computational cost, approximate Eq. with bounded error, and estimate C₂ using a single sample of instead averaging. The detailed derivation and justification can be found in Appendix A.2.1 and A.2.2 The final estimation of ea be derived as follows:
T
Ex arg min
Σ 1,,,,,,,,50)
(19)
2=
Empirical ablation experiments validate the effectiveness of this estimation, demonstrated in Table
10
To solve for é and avoid local optima, we employ an iterative method with momentum to estimate Cg instead of directly solving for a local minimum. this approach, we leverage the ensemble loss functions from different time steps in Eq. (2) Inspired by transferable adversarial attacks [39], we aim to find a transferable e, that navigates the diverse loss landscape using the momentum iteration algorithm.
m: -m (1 [(,,,ttt
(20)
= C:-1 m
Here, m; represents the momentum term iteration i. The details of the information about the transferable adversarial attacks can be found in Appendix D
Additionally, considering that Co serves reference prompt input that is typically expected to be highly correlated with the content of the image, we assume that co and e, are very close in the textual space. Then the iterative solution for e, can be initialized from Co-
A.2.1 Upper bound of c, estimation error.
Theorem A.I. Assume g m we have
Lipschitz continuous under L1 norm. Then, n oo.
1 ((x))
Vn n n
2
Σ
Fi
< 2L
(21)
n
π
where x; iid N(O, for
Proof. The Lipschitz continuity condition for the 1-norm can expressed as follows: For any I, pmxm there exists constant L > 0 such that [[g(z) g(vill L || -yll By taking the
17

---

difference of the two equations in Eq. 21
we have:
v2
lim
((x))
2
1=1
72
lim
(g(x))
9
T2
< lim R-+00
((m:)
(22)
==1
L
n
< lim -
1=1
i=1
lim
L
2
1=
42
2
2
Notice that for any i from 1 n.
yn
T2
Di=1 244
.N(. I).
(23)
2
2
mm
So we have:
2i=1
24
F)O,
(24)
V/
The folded normal distribution, denoted by F, has probability density function (PDF) given by
(x=
(xt
fr p, 0²)
(25)
V2T0²
for 2 0, and 0 elsewhere. The PDF can be simplified
2
pet 0²
f(x) =
20
cosh
(26)
To
where cosh is the hyperbolic cosine function. The cumulative distribution function (CDF) is given by
1 Fy
+ 1
11 22
2 erf
erf
(27)
22
for 2 O, where erf() is the error function. The expression simplifies the CDF of the half-normal distribution when ==00 0.
The mean of the folded distribution is given by
By σ
2
1-e
1
222 20
+
+
24
)-
(28)
where ((x) is the standard normal cumulative distribution function. The variance can be easily expressed in terms of the mean:
of 112 +0 +02 22
(29)
18

---

Denote the final expression in Eq. infinity:
22 as Y, we can obtain the following results n approaches
L
2
(n - 1). 12 2T.
2
B(Y) = lim
2
Vni
(30)
n vn ))
L
2
(n 1) 1). (1 1 π7
Var(Y) = lim
2
=
20000
This means that the upper bound for our estimation error is 2L
2
A.2.2 Single sample for
Based on the theorem's 's conclusion, we have the flexibility to choose between weighting before the forward pass or weighting after the forward pass during Gaussian sampling, while ensuring that their errors are within a certain upper bound. By introducing the scaling factor vTi, we are able to preserve the distribution characteristics of the input samples, which is crucial for subsequent diffusion processes.
An easy corollary of Theorem A. further states:
Corollary A.2. Let L(e) denotes Eq. for convenience, given t, z0, c, O. As n + oo, we have
n
n
vn
2
L(e)) -
< 2K
V
-
(31)
n2
π
where e, utd N(O, for i= : n, is finite.
To enable backpropagation, the model loss L(c) must be differentiable with bounded gradients, satisfying the Lipschitz continuity condition with respect to e. In Corollary A.2, we observe that
En yn E, I). Instead of computing the entire average,
directly sample from N(O, T) for the forward process. This allows estimating Eq, (18) practically with single sample c,
while ensuring that the estimation error is within certain range as introduced in E3.
Please note that this is a very coarse upper bound estimation. In practice, we find that the actual difference is far less than this upper bound. This may be because which has already been well-trained and generalized well to lots of inputs, making the loss typically very close and small (always within (K)). Therefore, we corroborate with experimental results and find that it unnecessary to resample e repeatedly in the process of optimizing Cg.
pretrained large model
Moreover, merely comparing the L values is insufficient. We must show that when L values are close, the difference between the corresponding values sufficiently small. When the loss difference [(c,) [(yy) is constrained within certain range, the text embedding difference e, Cy will also typically be limited, due to the following reasons:
Pretrained language generation models are extremely sensitive to even minor changes in input sequences [64], such as the prompt. These subtle alterations can result in significant variations in the model's 's predicted outcomes and loss function. Therefore, when the difference in loss constrained within a certain range, we can infer that the semantic disparity in the prompts is also effectively controlled.
Therefore, restricting the loss difference helps bound the text embedding difference, validating that the proposed с values indeed represent meaningful alternative text options rather than arbitrary or randomly perturbed sequences. This ensures the method can generate semantically-meaning alternatives expected.
19

---

A.3
Estimation of H
A.3.1 Derivation H
Directly computing the И matrix requires quadratic complexity, and calculating its inverse further requires cubic complexity. Even with A800 device with 80GB of memory, it is insufficient to support such a computational workload.
Recall that we are interested in estimating the inverse of the Hessian matrix H = - V. v. log g(c) oz
In general, the inverse of a matrix expensive to compute, especially for large matrices. Therefore, we seek to simplify the computation of H-1 by leveraging low-order information.
We begin by considering the second-order Taylor expansion of g(c) around Oe (flattened 59,136- dimension vector):
gc) ~ g(cx) + Vg(cx) cx) (c
2 (c- M(c--
(32)
Since og is the maximizer of g we have Vg(c,) Therefore, Eq. 32 simplifies to:
g(c)) 2 (c
cx)
(33)
We can obtain the estimation formula of H with respect to L(c) since - ((c) is used to compute g(c):
H = VVL(c)le.
(34)
Therefore, we have:
(co - H cz) 2(L(co) L(c))),
(35)
A.3.2 Simplification for Estimation of H-1
Research [65] has shown that word embeddings can represent word semantics through distributed, low-dimensional dense vectors. These embeddings capture linguistic patterns and regularities while requiring substantially less memory than sparse high-dimensional representations.
Based on the aforementioned research findings and previous approaches for variance estimation in Laplace modeling (66), we make the assumption that the Hessian matrix is positive definite diagonal matrix. This assumption is reasonable since calculating the Hessian matrix in the high-dimensional text feature space poses significant computational challenges for stable diffusion models. Furthermore, as the Hessian matrix represents the second-order derivative of the log-likelihood function, it must be positive definite at the maximizer
e, to ensure the local convexity of the function.
Definition A.3. Let (Co - cz) = [t,, 12,,...... tt. Let H diag (h1, h2..... ........le "h.....,,,), 1 h2 0, 1,2...., n. Denote 2(L(co) ((cx)). Define
Σ 43
From Definition we have:
T 0
0
h2
l2
(co - cx) T cz) = -11,,2,....
[n]
? hb
(36)
h
[
This implies that Eq. 35 can be written as:
Σ 2h:=1
(37)
Given Eq. 37 as n-variable linear equation, solving it alone is insufficient. Additional n-1 equations are required to obtain complete solution. However, due to the large value of n=51,396, solving this system of equations would be highly time-consuming.
20

---

To solve this problem, let's consider H = I² where o² is an unknown positive scalar and / is the identity matrix. Replacing H with H in A.3) we approximate o² as follows:
L
(38)
Li=1
1c0 Cz l
This implies:
A-1 (o21)
1000
Ca
(39)
On the other hand, in Definition A.3 we assume that the diagonal elements of matrix are bounded.
Since H is diagonal matrix, its eigenvalues (diagonal elements) are inherently bounded. In experiments with a learning rate of 0.001 and a step count 15, we have a bound of 10-6 for i from Eq. (37). This leads an upper bound of 10 L for > 1 h4, resulting in an average value of the hy sequence with an approximate upper bound of around 20L. Based on our observations, incorporate the following into our standard experimental configuration:
< suggesting value around 20 for 1/l, and subsequently determine that D < 12.5 (We will further explore the implications of different values of D Figure
Since Eq. 39 is considered as the final estimation of H 11-1111 is crucial to estimate the upper bound of the distance between H and H As both matrices are high-dimensiona. and diagonal, we employ the cosine dissimilarity, widely used metric for measuring the distance between high-dimensional vectors, to quantify the matrix distance. Specifically, we extract the diagonal elements of the matrices vectors and compute their cosine dissimilarity, which is defined as:
Cosine Dissimilarity (z)
(40)
The cosine dissimilarity ranges from to where 0 indicates that the vectors are identical, implies that they are orthogonal, 2 indicates they are maximally dissimilar. We first calculate the cosine similarity:
Similarity cos( H1 H )
म- H-1
11 - 11
Σ Di=1 h,a²
/n n
(41)
i= hi
1
Li=1 R?
7
D2
(n - 1)(2 + (n 1)
VnD
where and D are defined in Definition A.3
We conduct ablation experiments with different and D values, as shown in Figure 4 Under the standard setting (the yellow point in the bottom left), the cosine dissimilarity between f -1 and H is upper bounded by 0.0909. Even when D increases significantly (close 60), the cosine dissimilarity does not exceed 0.6.
While this simplification may introduce errors, it significantly reduces the complexity of computing the Hessian matrix, which heneficial for model training.
B Further Discussion for PAP
We propose to incorporate prompt sampling and optimization into the PGD framework, analogous to AdvDM. Inspired by CW attacks (52), which maps adversarial examples to the tanh space, we can relax the constraints on the optimization problem compared to standard PGD.
21

---

Cosinee Diocimlarity
b600
1-330
22600
Figure 4: Cosine dissimilarity between ft and H under different settings of D and L.
Specifically, instead of clipping the perturbations to the [2o - 17, xi + 7] box as in PGD, we can allow the perturbation vary in the entire space by modifying the image
ady
(tan(() 1)
(42)
This has two key advantages: 1.The perturbations are no longer bounded by n, allowing for more flexible optimization; WeWe leverage the derivative properties of tanh:
d tanh x)) = 1 tanh (x)
(43)
dr
perform gradient computations without additional cost.
Overall, modifying the space in this way could lead to a smoother optimization process and is promising direction for future improvement. The full algorithm would involve iteratively optimizing both the prompt embedding and image perturbations via signed gradient steps.
C Generalized Prompt-agnostic Adversarial Perturbation
PAP algorithm incorporate other arbitrary optimizers, such as ASPL, FGSM. The pseudo-code in Algorithm 3 as an improved algorithm AS-PAP. is worth noting that when we set the text sampling step to our AS-PAP algorithm is essentially equivalent to Anti-DB [22].
D Transfer-based Adversarial Attacks
When crafting adversarial examples, the objective to find perturbations that maximize the loss function, leading to misclassification decrease in the model's confidence. However, the loss landscape is often complex and non-convex, with numerous local optima and saddle points (67). This landscape structure poses challenges for optimization algorithms, gradient-based -based methods can easily get trapped in local optima, resulting in suboptimal or non-transferable adversarial examples.
In the context of our approach estimate ca, by treating different instances of the loss function L; as individual "classifiers" mentioned in above works and incorporating momentum in the optimization process, we aim to steer the convergence towards flatter regions in the timestep t landscape. This strategy allows us to find a value of c, that minimizes the expected value of the integral Eq. (18) while promoting improved generalization across the sampled loss functions Lt-
Analyzing and leveraging loss landscape in classification adversarial attack opens up new avenues for understanding and improving adversarial robustness. Exhaustive enumeration of all possible perturbations is often computationally expensive and time-consuming. On the other hand, solely fitting the optimization process few sampled time steps can lead to overfitting and lack of
22

---

Algorithm 3 Alternating Surrogate and Prompt-agnostic Adversarial Berturbation(AS-PA
Input: images 2o, reference prompt c, parameter 0, epoch numbers M, N, K, Mar, learning rates a, r. B. y, budget 7, noise steps T, loss function L(x, C, 0)
Output: Adversarial examples x
Initialize x8 = 40
for to N 1 do
Sample le & (0, T), ~ 1)
Compute gradient 9. Ve, (20. Ec. te: cy:
Compute momentum m 8m; (1 3)9c
Update 95+1 = end for
for k == to K do
M. Co for i= 0 to M do
Initialize x0
Sample e, fc (0, I), (0,
1cg 3
Compute eN +
Li (tter))) Ee
Update x/41 clip zo. (x + a V (=t,(,)
end for for m = to Max-1 do
0 - 1 Vo
end for end for
generalization. provides insights into the optimization process and offers opportunities to develop more effective and transferable adversarial attacks and defenses.
E
Implementation Details
E.1
Additional Details
Artists Name: vangogh, john-miler, alfred-sisley, pablo-picasso, abraham
Test prompt contents: The specific prompts we use for test on Celeb-HQ, VGGFace2 and Wikiart shown in Table
Celeb-HQ and VGGFace2
Wikiart
p0
photo sks person.
a sks painting. sks painting of tree. a photo of dog in the style of sks painting.
pl
dsir portrait of sks person.
p2
an impressionistic depiction of sks person.
p3
an abstract representation of sks person.
a photo of person the style of sks paint- ing.
p4
cyberpunk style photo of sks person.
a sks painting of a starry night. a photo of lion in the style sks painting.
p5
realistic painting of sks person.
p6
concept art of sks person.
photo of a sunflower in the style of sks painting.
p7
headshot photo of sks person.
photo of modern building in the style of sks painting. a photo of robot machine in the style of sks painting. a photo of the Mona Lisa the style of sks painting.
p8
caricature sketch of sks person.
p9
digital portrait sks person.
Table 7: Test prompts
23

---

E.2 LoRA
LoRA a method that utilizes low-rank weight updates to improve memory efficiency by decom- posing the weight matrix of pre-trained model into the product of two low-rank matrices, i.e., W AB. This low-rank weight decomposition reduces parameters, minimizing storage needs. While simple, LoRA enhances memory efficiency crucial for large models on constrained hardware. However, defenses alone are limited versus robust methods. LoRA primarily optimizes efficiency over security, so is used to validate stronger defenses against complex attacks. Combining LoRA with such defenses yields balanced, resilient machine learning.
E.3 Textual Inversion
Textual Inversion allows users to personalize text-to-image generation models with their own unique concepts, without re-training fine-tuning the model.
The key steps are:
1. Represent new concept with a pseudo-word S"
2. Find the embedding vector v* for this pseudo-word S by optimizing the following objective using small set of images depicting the concept:
arg min Pe.-Ele))..e--11.... [lle - (,
(44)
where E is the encoder of pre-trained Latent Diffusion Model (LDM), are the input images, y are prompts of the form "A photo of S 68 is the denoising network, co the text encoder, is the noised latent code, and is the timestep.
3.
Use the learned pseudo-word 5* (represented by v²) in natural language prompts to generate customized images with the text-to-image model, e.g., "A painting of 5*"
E.4
Metrics
CLIP (Contrastive Language-Image Pretraining) is framework that not only enables cross-modal understanding between images and text but also allows direct comparison between two images. The CLIP metric measures the similarity between two images using their embeddings.
The CLIP similarity between two images 1 and 12 can be calculated using the following formula:
CLIP 12) (os)im((((),, +1
(45)
2
Here, the terms have the following meanings:
I: the first image, Iy: the second image, f(11: ) the embedding of the first image, f(22): the embedding of the second image, CosSim(z, y): the cosine similarity between vectors x and y.
The formula calculates the cosine similarity between the embeddings of the two images. The resulting similarity is normalized to the range [0, 1] by adding 1 and dividing by 2. A higher CLIP value indicates a stronger similarity between the two images. CLIP models are trained on large-scale datasets to learn joint embedding space for images and text. This enables the models capture similarities and differences between images using their embeddings. By comparing the embeddings of two images using the cosine similarity, CLIP provides measure of their visual similarity. The CLIP metric can be used in various tasks such as image retrieval, image similarity search, and image clustering. allows for effective comparison and organization of images based on their visual content, without the need for explicit labels or annotations.
LPIPS (Learned Perceptual Image Patch Similarity) is metric used measure the perceptual similarity between two images. It takes into account the local image patches instead of global image features, making it more aligned with human perception. The LPIPS metric is calculated using the following formula:
W ww
d(x,xo)
(ithw
Vtokw) )l2
(46)
H₁ W1
h=1
24

---

d: the input to the model, z0: the reference input, I: the layer index, Hy: the height of the feature map at layer I, Wi: the width of the feature map at layer 1, Gllw: the predicted output of the model at position (h, w) in layer I, i/0hw:: the predicted output of the model at position (h, w) in layer I for the reference input To. wy: the weight associated with the position (h, w) in layer / The formula calculates the squared Euclidean distance between the weighted differences of predicted outputs at each position (h, w) in layer I, normalized by the total number of positions (H1 W2). This quantifies the perceptual similarity between the input and the reference imput zo at the specified layer. LPIPS Here, the terms have the following meanings:
provides a perceptually meaningful measure for comparing images, capturing both local and global information. It has been widely used in various computer vision tasks and can be especially useful for evaluating the performance of image synthesis models.
BRISQUE is widely used no-reference image quality assessment metric that evaluates the quality of an image without relying on a reference image. It computes a quality score based on statistical features extracted from the image, such as brightness, contrast, and naturalness. The BRISQUE score ranges from O to 100, with higher scores indicating better image quality. The computation involves:
1. Extracting local normalized luminance statistics from the image.
2. Computing a feature vector from the statistics using pre-trained model.
3. Mapping the feature vector to quality score using support vector regression model.
BRISQUE is effective in capturing distortions introduced by various image processing operations and is widely used in benchmarking image generation models.
LAION aesthetics predictor is a linear model that takes CLIP image encodings as input. was trained on dataset of 17,600 images rated by humans. The images the training set were scored on a scale from I to 10, with higher scores typically indicating artistic quality. In subsequent experiments, the LAION aesthetics predictor assigns scores samples generated by diffusion models. Higher scores indicate a higher level of artistic quality in the images.
E.5 Baselines
To ensure fair comparison, we followed the original settings of AdvDM, IadvDM, and Anti- Dreambooth in our experiments. We constrained the noise budget to be the same for all methods and focused on comparing their performance in untargted scenarios. This approach avoids the bias introduced by selecting specific target images, as each method may have its own optimized target image. Hence, we standardized the evaluation by considering untargted scenarios. For the attack stage, we set the number of steps to 20. If a method involved training Dreambooth, we limited the training steps to 10. To expedite the training process, we used batch size of 20 for training Dreambooth.
F Additional Study
F1
More evidence of protecting fail of previous methods
The Table & presents the results of previous protective perturbation methods (No defense, AdvDM, and Anti-DBB the CelebA-HQ dataset, evaluated using the BRISQUE (higher is better) and CLIP (lower is better) metrics. The results are reported for ten different test prompts, where p0 is the same as the training prompt.
For the training prompt pO, both AdvDM and Anti-DB outperform the "No defense" baseline, achieving higher BRISQUE scores (39.85 and 40.08 vs. 21.20) and lower CLIP scores (0.2053 and 0.1877 vs. 0.4821). This indicates that the protective perturbations are effective when the test prompt matches the training prompt.
However, for the other test prompts (pl to p9), which differ from the training prompt, the performance of AdvDM and Anti-DB is not consistently better than the "No defense" baseline. For instance, considering the BRISQUE metric, AdvDM achieves similar scores to "No defense" for prompts p2 (29.45 vs. 27.65), p4 (29.78 vs. 28.45), and p7 (26.89 vs. 26.73). Anti-DB shows similar BRISQUE
25

---

Training
Tost promptt: pholo daa
Test prosupt:
portr att alta person
promupt: aclife phote
person
top
mocmnnt faji
Training
promptt: paintinng
prompit: painting portrait
Text prompé: painting
Visualized results of different test prompts toward Anti-DB method on the CelebA-HQ dataset and Wikiart dataset, with training prompt: a photo of sks person (top) / a sks painting (bottom). The left column are adversarial examples (denoted AE) by Anti-DB.
Figure 5:
scores to "No defense" for prompts p3 (33.14 vs. 29.11), p5 (31.51 vs. 30.22), and p7 (31.74 vs. 26.73).
The CLIP metric also exhibits a similar trend, where AdvDM and Anti-DB do not consistently outperform "No defense" for prompts different from the training prompt. For example, AdvDM has similar CLIP scores to "No defense" for prompts p2 (0.3124 vs. 0.2543), p4 (0.3267 vs. 0.2987), p7 (0.2654 vs. 0.3015), p8 (0.3012 vs. 0.2976). p9 (0.3129 vs. 0.3211) indicating poor defense performance.
These observations suggest that while AdyDM and Anti-DB effective in protecting against the training prompt, their performance deteriorates when the test prompt deviates from the training prompt. This highlights the challenge developing robust protective perturbations that can generalize to unseen prompts, which is a crucial requirement in real-world scenarios.
Table 8: Results of previous protective perturbations using ten different test promtps (Prompt contents in Table of Appendix) on the CelebA-HQ dataset. p0 is the same as the training prompt.
Metrics
Method
p0
p3
p7
defense
21.20
15.34
27.65
29.11
18.45
30.22
27.89
26.73
31.05
28.98
BRISQUE<T)
AdvDM
39.85
29.45
35.67
29.78
37.25
26.89
36.52
32.23
Anti-DB
40.08
38.96
36.65
33.14
34.98
31.51
32.82
31.74
37.66
35.98
0.4032
CLIP (U)
AdvDM
0.2053
0.2687
0.3124
0.2845
0.3267
0,2895
0.2532
0.3015
0.2976
0,3211
Anti-DB
0.1877
0.2612
0.3029
0.2754
0.3165
0.2459
0.2924
0.2884
0.3115
Additionally, from Figure 5 when the test prompt matches the training prompt (e.g. green prompt, the test images exhibit stable interference. However, when the test prompts differ, the test images maintain high quality and semantic consistency with test prompts, nearly resembling scenarios without any defense. This failure in previous protection evident from the red prompt-generated images in Figure 5
F.2 Sampling steps for training DreamBooth
The selection of the number steps for fine-tuning is also a critical factor that affects the quality of the generated images. Therefore, we conducted ablation experiments with different sampling step values: 500, 1000, 1200, 1600, and 2000. The results Table demonstrate the stable defense effectiveness of method across different sampling test step settings.
26

---

Table 9: Ablation study of sampling test steps.
Sampling steps
(1)
CLIP-1(4)
LPIPS
(JI
BRISQUE
(U)
500
452.0
0,5467
0.7363
5.293
38.91
0.2875
1000
4488.3
0.5641
0.7782
5.490
38.47
0.2654
1200
437.9
0.5909
0.7889
5.419
38.12
0.2387
1600
446.8
0.5948
0.7683
5.587
37.98
0.2032
433.2
F.3
Sampling steps for sampling steps
also analyze the effect sampling steps used to estimate Cx, which approximated in our method. As shown in Table [T]] metrics such as FID, CLIP, and LPIPS peak at 10 steps, then stabilize and resemble the 0 step results from 15 steps onward. This validates our method for approximating in Eq. ().
Table 10: Ablation study of sampling steps Wikiart.
sampling steps
FID (7)
CLIP-- (L)
LPIPS (?)
448.3
0.5641
446.8
0.5607
0.7743
482.2
0.5598
0,7801
454.5
0.5639
0.7788
20
453.9
0,5602
0,7775
F.4 Noise budget
Table shows the impact of the noise budget 77 PAP's defense performance. The trade-off between noise stcalthiness and defense performance is important to consider. A noise budget of 77 0.05 is effecttve, but increasing the budget improves performance at the expense of stealth.
We provide detailed analysis of the impact of noise budget on our experimental results, with additional visualizations available in Figure In general, larger noise budget yields better defense performance. However, also introduces more noticeable image distortions. In extreme cases, excessive perturbations can degrade the image to pure noise, defeating the purpose of our task. Hence, striking balance between protection effectiveness and the magnitude of image perturbations becomes essential.
F.5 Other Pseudo-word
In experiments, conducted evaluations using the commonly used pseudo- pseudo-word "sks," which representative but may not cover all possible cases. To further validate our method, we included additional less commonly used porudo-words. We selected three traditional metrics for measuring image similarity, and the results in Table 12 clearly demonstrates that our method consistently outperforms the others.
F.6 Robustness
Adversarial examples often lose their protective effect on images when subjected image operations such as Gaussian blur, JPEG compression, etc. Therefore, we conduct robustness tests specifically targeting the JPEG compression and Gaussian Blur. We evaluate the quality of the generated images at different settings, as shown in Table [3 Despite slight decline in our results after applying these treatments, worth noting that the evaluation based on image quality metrics still demonstrates favorable outcomes. This suggests that our method maintains a good level of effectiveness even in presence of JPEG compression and Gaussian Blur.
E.7 Targeted Attack
Targeted attack on generative models aims to perturb an input image towards a specific target image, resulting in outputs that closely resemble the target. Compared to untargeted attack, targeted attack
27

---

Table 11: Ablation study of noise budget, ranging from 0.01 to 0.15,
(1)
CLIP-(() (J)
LPIPS (T)
LAION (1)
BRISQUE (T)
CLIP (})
198.7
0.7715
0.6193
6.367
21.34
0.3515
0.01
262.7
0.7188
0.6522
5.994
31.12
0.3154
0.03
334.8
0.6633
0.6840
5.603
35.57
0.2896
0.05
448.3
0.5641
0.7782
5.490
38.47
0.2654
0.15
512.9
0.4208
0.8755
4,635
46.26
0.1716
Table 12: Comparison with other adversarial attack methods with pseudo-word "t@t"
Dataset
Method
FID (1)
CLIP-IT)
IPIPS (1)
Clean
142.3
0.7872
AdsDM
187.8
0,7023
0.5213
Celeb-HQ
Anti-DB
0.6961
IAd-DM
161.6
0.7488
0.4912
PAP (Ours)
228.6
0.5749
0.6348
Clean
AdsDM
240.6
0.64322
0,5733
VGGFace2
Anti-DB
254.4
0.6307
IAd-DM
244.9
0.6336
0.5955
PAP (Ours)
272.8
0.5301
0.6877
AdvDM
313.7
0.6704
0,6558
Wikiart
Anti-DB
349.2
0.6489
0.6910
IAd-DM
302.8
0.6641
0.6590
PAP (Ours)
383.0
0.6167
0.7168
achieves more consistent and effective results. We conduct additional experiments. The results
presented in Table 14
F88 The Performance of the Trained Prompts
In Table 15, our method slightly trails behind the SOTA by 0.01/39.57 in LPIPS/FID respectively. However, our method still maintains a leading position in ISM, FDFR, BRISQUE, and CLIP metrics.
F.9 Time Comparisons with Baselines
In Table 16 present the time required for each method. The results demonstrate that PAP introduces an average computation time of processing a set of images (<300s). In the future, we aim further optimize the algorithm reduce the time within minutes.
F.10
Error Bars
Due the sampling from three different distributions involved in algorithm, the results obtained in each experimental run may exhibit slight variations. To address this, we conduct multiple independent repetitions of the experiments and calculate the mean and standard deviation for each evaluated metric. The results are then presented with error bars, providing more comprehensive assessment of the algorithm's performance.
Specifically, each metric to be evaluated, we perform N 10 independent experiment repetitions, obtaining N result values æ1, .2...., N.N. The mean μ and standard deviation of these values are calculated as follows:
(47)
N
(48)
1=1
28

---

Table 13: Metrics for images generated by PAP after JPEG compression or Gaussian Blur.
LAION
BRISQUE
PAP
5,490
38.47
JPEG Comp. Q=10
5.732
45.33
JPEG Comp. Q=30
34,29
JPEG Comp. Q=50
5.561
33.611
Comp. Q=70
39.34
Gaussian Blur K=3
5.882
41.88
Gaussian Blur K=5
5.796
42.08
Gaussian Blur K=7
5.552
43.76
Gaussian Blur K=9
5.991
41.20
Table 14: Ablation study of targeted attack.
FID (t)
CLIP-I
LPIPS
LAION (L)
BRISQUE
CLIP (4)
untarget
448.3
0.5641
0.7782
5.490
38.47
0,2654
Largel
492.1
0.5335
0.7922
4.974
40.23
0.2108
When plotting the results, we use the mean fr as the metric's result value and the values + a as the upper and lower limits of the error bars, respectively. By presenting the error bars, we aim to provide a more reliable and informative evaluation of our proposed method.
As shown in Figure 6 the error bars of our PAP method demonstrate the stability and consistency of our method's performance across different runs.
G Impact Statements
Powerful customized diffusion models enable many applications but also raise privacy and intellectual property concerns [68
19 misused reconstruct private images or replicate protected artistic Previous work on privacy protection has been questioned in its effectiveness 770 71 and suffers from a lack of generalization unknown prompts [22]. Our proposed Trompt-agnostee Adversarial Perturbation technique aims to address the limitations by considering the distribution of text prompts the attacker may use. Experiments demonstrate our approach more effectively prevents unauthorized use of sensitive private data and artistic styles compared to state-of-the-ae baselines under unseen prompts. By enhancing resilience against unseen attacks targeting uncontrolled generation, our work can help balance Al's societal benefits with mitigating privacy and legal risks, and provides insights towards continued research on defense techniques that responsibly enable trustworthy applications involving generation of human data.
works without consent 6
69
However, our model could also be used maliciously contaminate data sources. If adversarial exam- ples generated by our model are mixed with regular natural images, it could potentially contaminate the entire dataset, leading its abandonment, as the adversarial perturbations we introduce may be difficult to detect.
H Limitations and Future Work
H.1 Semantic Relevance in Prompt Sampling
While modeling the prompt distribution as a continuous Gaussian distribution reasonable approx- imation, must acknowiedge that the sampled values may not always reflect realistic semantics in the text feature space. For instance, simply adding noise to text embedding can result in incoherent sentences that lack real-world meaning. This poses a challenge to the effectiveness of our global protection when sampling from the prompt distribution. reality, we aim to consider prompt samples that are both close to the mean and contain meaningful semantic information, resembling discrete scenario.
To further explore the relationship between the estimated prompts and natural language, we have conducted a visual experiment Figure 7 By reducing the dimensionality of 10 test prompts' embeddings and ex using PCA, we visualize the estimated prompt distribution and test prompts projected low-dimensional space for the tasks of "Facial Protection" " (left) and "Preservation of Artistic Style" (right) respectively. The figures demonstrate that the two principal components of
29

---

Table 15: Performance of the trained prompts.
Method
LPIPS
BRISQUE
CLIP
AdvDM
0.65
0.61
0.39
33.68
301.55
0.25
Ami-DB
0.71
0.34
32.24
277.24
0.24
IAdvDM
0.65
0.57
0.43
33.55
296.31
0.28
PAP
0.70
0.68
0.33
36.43
261.98
0.24
Table 16: Time comparisons with baselines.
Method
AdvDM
Anti-DB
IAdVDM
PAP
Time
262s
288s
204s
297s
test prompis are discretely distributed within the modeled prompt distribution, indicating flexible probability of being selected for adversarial attacks. This illustrates that our modeling effectively covers range of natural language inputs in the semantic space.
Gau sslan heatmap with Teatures
Caussion Hestmap with Feetures
60-
TCA
20
44
0.4
-20
-20
03
-42
83
-40
Figure 7: Evaluation of generation performance of models across different stable diffusion versions on different metrics.
In future work, one potential improvement to discretize the modeled Gaussian distribution by introducing restriction module, denoted as F. This module would reject prompt samples lacking semantic information, allowing only those with strong semantic relevance to enter the optimization process. This approach would provide a more accurate representation of meaningful alternative text options.
H.2 H-1 Estimation
In estimating 111 we made simplifications that inevitably introduced errors. Although we theoreti- cally demonstrated that the upper bound of the errоr caused by our simplification is sufficiently small, it is worth exploring if there are alternative estimation methods that can achieve even smaller and more accurate errors.
In future work, we may consider other estimation approaches for H-1 such as matrix low-rank decomposition, pursue rigorous approximation. By exploring these alternative methods, aim to discover more precise and reasonable estimations for H-1
30

---

All six metric results with error bars on the CelebA-HQ dataset
0.5
Matric Value
0.4
0.3
0.0
FID
CLIPI
LPPPS
LAVON
BRISQUE
CLIP
Figure 6: All six metric results with error bars on the CelebA-HQ dataset. The error bars indicate the stability of the results across multiple runs. For the purpose of visual representation, the results of FID, BRISQUE, and LAION in the graph are obtained by multiplying the original data by 0.001, 0.01, and 0.1, respectively.
31

---

I Visualization
Protecting Images
Training Prompt photo of sks person
Generated Images
DD
RI
Clean
AdvDM
Anti-DB
IAdvDM
PAP(Ours)
photo of sks person
dsir portrait of sks person
impresston- nistic depiction of sks person
ryberpunk style photo sis person
sks painting
sks painting bree
photo of dog in the style sks painting
sks pointing stuny night
Prompt:
VGGFacE2
Wikiart
Figure 8: Clean examples and generated images (qualitative defense results) of different methods in VGGFace2 (left) and Wikiart (right). Each row represents method, and each column represents a different test prompt (shown at the bottom). The adversarial examples generated by our method effectively defend against all prompts in both datasets. In contrast, other comparison methods primarily focus on protecting the fixed prompt (the first column), resulting in compromised defense for other prompts.
32

---

Protecting Images
Adversaria Examples
0.01
0.03
0.05
0.10
Figure 9: Clean examples and corresponding adversarial examples generated by our method with different noise budgets (ranging from 0.01 to 0.15) on VGGFace2. The training prompt is "a photo of sks person".
33

---

Protecting Images
IF
A dvvesarial Examples
Generated Images
sleps 500
steps 1000
0.01
0.03
0.05
0.10
0.15
Figure 10: Top: clean examples. Bottom left: adversarial examples produced by our method with different noise budgets (ranging from 0.01 to 0.15) on VGGFace2 with training prompt: "a photo of sks person". Bottom right: corresponding generated images of stable diffusion with sampling steps 500 and sampling steps 1,000.
34

---

Protecting Images
Generated Images
0.01
0.03
0.05
0.10
0.15
IAdvDM PAP(Ours) Figure 11: Top: clean examples. Bottom: generated images of different methods with different noise budgets (ranging from 0.01 to 0.15) on VGGFace2. The training prompt is "a photo of sks person".
A Anti-DB
IAdvDM
PAP(Ours)
AdvDM
AntiDBB
Inference prompt: dsir portrait of sks person.
Protecting Images
Anti-DB
PAP(OUrS)
0.01
0.03
0.05
0.10
0.15
Inference promp:: an impressionistic depiction of sks person.
Anti-DB
PAP(OUrs)
0.05
0.10
0.15
Figure 12: Left: clean examples. Top right: generated images of Anti-DB and our method with different noise budgets (ranging from 0.01 to 0.15) on VGGFace2. The inference prompt is "a dsir portrait of sks person". Bottom right: generated images of Anti-DB and our method with different noise budgets on VGGFace2. The inference prompt is "an impressionistic depiction of sks person".
35

---

Protecting Images
Generated Images
sks painting
sks painting of tree
photo of beach in the style of sks painting
sks painting of a portrait
0.03
0.10
0.15
Figure 13: Left: clean examples. Right: generated images of our method with different noise budgets (ranging from 0.01 to 0.15) and prompts on Wikiart.
Protecting Images
Generated Images
sks painting
sks painting of tree
sks painling staryy night.
sks painting portrait
0.01
0.03
0.05
0.10
0.15
Figure 14: Left: clean examples. Right: generated images of our method with different noise budgets (ranging from 0.01 to 0.15) and prompts on Wikiart.
36

---

Protecting Images
Gemerated Images
sampling steps 500
sampling stops 1,000
sks painting
photo of a beach in the style sks painting
photo of mountains the style of sks painting
sks painting of portrait
sks painting of staryy night
a sks painting of tree
Anti-DB Figure 15: Top: clean examples. Bottom: generated images of our method with different prompts and sampling steps (500 and 1,000) on Wikiart.
PAP(Ours)
Anti-DB
PAP(Ows
37

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Please see Appendix H
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
38

---

We provide the full set of assumptions and a complete (and correct) proof for each theoretical result.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper fully discloses all the information needed to reproduce the main experimental results of the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
39

---

Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
The paper provides open access the data and code, with sufficient instructions to faithfully reproduce the main experimental results
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.cc
aublic/guidee//ooeeeuliiiss
www.sssinnooiiilloooooo for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips. wwtps/cccppclgguuuiiaeeeaec wtw.eeeeeeoSSSeeesS..eoeee..
www.sssoiccgyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The paper specifies all the training and test details necessary to understand the results.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The paper reports error bars suitably and correctly defined about the statistical significance of the experiments in Appendix F.10
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
40

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: For each experiment, the paper provides sufficient information the computer resources needed to reproduce the experiments.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental rums as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:://ettttuips..cccc. http:/rrippp.cpppppcb//heecccccc ttw.
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discusses both potential positive socictal impacts and negative societal impacts of the work performed in Appendix G
Guidelines:
41

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negatíve societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: The paper does not pose any risks requiring safeguards for responsible release of data or models with high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: the creators or original owners of assets, used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
42

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thcode. com/ com/dataseta has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's ' creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We propose new algorithm and provide accompanying codes. Please refer to the supplementary materials submitted for detailed codes.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing experiments research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve research with human subjects
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
43

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
44


Reviews:
[{"review_id": "EJRI9ZKs79", "reviewer": "Reviewer_JA4c", "summary": "The authors propose a prompt-agnostic adversarial perturbation (PAP) method for customized diffusion models. They first use Laplace approximation to model the prompt distribution. Then they derive the attacks by maximizing the disturbance expectation. Extensive experiments on three datasets validate their performance.", "questions": "1 This paper only mentions the time complexity of their approach in Line 226, but what are the time comparisons with baselines?\n\n2 Only considering SD 1-5, however more versions of stable diffusion models and other diffusion models should also be considered. Could you please provide more results on other models to show the generalization of your approach?\n\n3 The authors only show the average performance across 10 similar prompts. What is the performance of the trained prompts? \n\n4 The authors use a Laplace to approximate the prompt distribution, but why is it a proper approximator? Additionally, in my point of view, the approximation is in the semantic space. However, the users will input natural language. Therefore, how to combat the domain gap is another concern.", "limitations": "Yes", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "Experiments on three datasets.\n\nInteresting topic.\n\nMathematical Proof.", "weaknesses": "Potential semantic gap between the estimated prompts and natural language.\n\nExperiment Scope: only do experiments on SD 1-5.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer JA4c,\n\nThank you for your valuable feedback and insightful comments on our work. We appreciate your suggestions and have made the following improvements: \n\nQ1: Potential semantic gap between the estimated prompts and natural language\n> a) We emphasize the importance of considering prompt samples that are not only close to the mean but also embody meaningful semantic information to bridge the semantic gap between the estimated prompt distribution and natural language in Appendix H.1. As part of our future work, a proposed restriction module could discretize the Gaussian distribution, thereby sieving out prompts devoid of semantic relevance to facilitate the generation of more meaningful text options, as detailed in Appendix H.\n\n> b) To further explore the relationship between the estimated prompts and natural language, we have conducted a visual experiment in **Figure R2** of the rebuttal.pdf. By reducing the dimensionality of 10 test prompts' embeddings and $c_N$ using PCA, we visualize the estimated prompt distribution and test prompts projected in a low-dimensional space for the tasks of \"Facial Protection\" (left) and \"Preservation of Artistic Style\" (right) respectively. The figures demonstrate that the two principal components of test prompts are discretely distributed within the modeled prompt distribution, indicating a flexible probability of being selected for adversarial attacks. This illustrates that our modeling effectively covers a range of natural language inputs in the semantic space.\n\nQ2: More versions of stable diffusion models should be considered.\n> Per your advice, we have conducted additional experimental evaluations on the Wikiart dataset using SD1.4 and SD2.0.\nThe results in **Figure R1** of the rebuttal.pdf indicate that the PAP method continues to show significant improvements on various diffusion versions, demonstrating the generalization of our approach.\n\nQ3: Time comparisons with baselines\n> In **Table R1**, we present the time required for each method. The results demonstrate that PAP introduces an average computation time of processing a set of images (<300s). In the future, we aim to further optimize the algorithm to reduce the time to within 4 minutes.\n\n> **Table R1**: Time and VRAM comparisons with baselines.\n| Method | AdvDM | Anti-DB |IAdvDM | PAP| \n|---|---|---|---|---|\n| Time| 262s|288s|204s|297s                 \n\nQ4: What is the performance of the trained prompts?\n> In Table 6 and Figure 5 of Appendix F, we have already presented the performance of previous methods for each prompt, including the trained prompts. Furthermore, we have extended the display of the performance of the trained prompts for all methods. In **Table R2**, our method slightly trails behind the SOTA by 0.01/39.57 in LPIPS/FID respectively. However, our method still maintains a leading position in ISM, FDFR, BRISQUE, and CLIP metrics. \n\n> **Table R2**: Performance of the trained prompts.\n| Method| LPIPS($\\uparrow$) | FDFR($\\uparrow$) | ISM($\\downarrow$) | BRISQUE($\\uparrow$) | FID($\\uparrow$) | CLIP($\\downarrow$) |\n|---|---|---|---|---|---|---|\n| AdvDM| 0.65| 0.61| 0.39| 33.68| **301.55**| 0.25|\n| Anti-DB| **0.71**| **0.68**| 0.34| 32.24| 277.24| **0.24**|\n| IAdvDM| 0.65 | 0.57| 0.43| 33.55| 296.31| 0.28|\n| PAP| 0.70|**0.68**| **0.33**| **36.43**| 261.98| **0.24**|\n| No Defense|0.50| 0.01| 0.55| 23.22| 128.31| 0.38|\n\nQ5: Why is  Laplace Approximation a proper estimator?\n> a) Approximation of Gaussian distributions: The Laplace approximation often yields a Gaussian distribution. In many cases, especially for large amounts of observed data and problems applicable to the central limit theorem (which aligns with the prompt embedding space), the true distribution may approximate a Gaussian distribution. This implies that, for large samples, the Laplace approximation provides a good asymptotic approximation of the shape of the probability density function;\n\n> b) Computational simplification:  Compared to more complex methods such as Monte Carlo simulations, the Laplace approximation often has computational advantages. It provides a relatively straightforward way to approximate the true distribution, especially when the analytic form of the distribution is difficult to handle or unavailable (our ideal prompt distribution is challenging to solve analytically as discussed in Section 3.2). This simplification makes the Laplace approximation practical in real-world problems.\n\n> c) We analyze the properties that the ideal prompt embedding distribution should meet: **P1**. The distribution should be centered around the extreme points $c_x$, with probability decreasing as semantic relevance diminishes, and with a large number of samples; **P2**. The analytical form of the distribution is unavailable. **P1** aligns with the use of Gaussian distribution for approximation, as discussed in a), while **P2** corresponds well with the situation described in b). These indicate that the scenario we are addressing is highly suitable for Laplace modeling.\nSubsequently, by Taylor expanding at $c_x$, we determine an approximate Gaussian distribution (Section 3.3.1) and introduce two estimators (Section 3.3.2): one minimizing the generation loss and the other performing a Taylor expansion around $c_x to estimate their mean and variance, respectively. We also provide a detailed explanation of the error bounds resulting from the approximation of these estimators in Appendix A, thereby theoretically supporting the validity of our Laplace estimation. Furthermore, the extensive experimental results presented in the paper (Tables 1/3/4/10, Figures 2/3/4/6, visualization results in Appendix I) empirically reinforce the validity of our approach.\n\nIn conclusion, we look forward to further discussions and insights on our work. Your feedback has been invaluable in shaping our research, and we are eager to continue this dialogue. Thank you for your time and consideration.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xxJLIbacWB", "reviewer": "Reviewer_JLDf", "summary": "- This work is about a method to craft perturbation images to protect users/artists from personalized text to image diffusion methods (specifically DreamBooth and Textual inversion), that generalize better to unseen prompts than previous works.\n- The core algorithm is \"Prompt-Agnostic Adversarial Perturbation\" (PAP). Instead of crafting the perturbation with a fixed condition prompt, PAP model the prompt distribution as a Gaussian dist and sample prompt embedding from it during the perturbation crafting process.\n- The prompt distribution is modeled as a Gaussian using Laplace approximation. The mean is estimated by minimizing the diffusion loss starting from a reference prompt. The variance is approximated using a simplified formula based on the difference between the reference and estimated prompts, and their respective loss values.\n- Experiments show PAP outperforms previous prompt-specific methods on metrics like FID, CLIP similarity, and LPIPS across different datasets (CelebA-HQ, VGGFace2, Wikiart) and generalization to unseen test prompts.\n\n(after rebuttal)\nThe authors addressed my main concerns by including results from newer methods with PAP, and clarifying the inconsistent implementation. Despite some issues regarding efficiency and application to more recent personalized techniques/model, I've increased my score from 4 to 5.", "questions": "- I wonder if PAP can help reduce the sensitivity to the initial prompt when crafting the perturbation between different domain. For example, when testing on human faces or artwork datasets like Wikiart, how would the performance change if in both dataset, $c_0$ is initialized with a very general term, such as an empty string \"\"\n- Pseudo code seems to be not consistent with the implementation. As in your provided implementation, $c_N$ will be recalculated every step in M, while the pseudo code $c_N$ is calculated only once at the start. I wonder if it could affect the performance of the method\n\n- Nitpick: L296 Typo BROSQUE. Table 4 need to have metrics such as FID, LPIPS to be more comprehensive", "limitations": "Since PAP still build upon anti-dreambooth, 4-6 minutues A800 when crafting a set of images is still very impractical. Again, I want to see performance of PAP on top of more recent/efficient methods\n\n[1] Xue, Haotian, et al. \"Toward effective protection against diffusion-based mimicry through score distillation.\" The Twelfth International Conference on Learning Representations. 2023.\n\n[2] Wang, Qixun, et al. \"Instantid: Zero-shot identity-preserving generation in seconds.\" arXiv preprint arXiv:2401.07519 (2024).", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper is generally well-written, with consistent improvement on unseen prompts when compare with previous works.\n- PAP is simple and easy to use, not very costly to add on top of other protection method\n- The explanation of the method is easy to understand\n- The paper also includes performance under DiffPure, and the result under DiffPure seems to be positive\n- The supplementary is informative, with extensive evaluation", "weaknesses": "The experimental evaluation need to be improved:\n- Apply PAP to other methods like AdvDM + PAP, not just Anti-DreamBooth ASPL, and other recent method such as Diff-Protect [1] to better demonstrate that PAP is a good plug in to the current methods.\n- Lacking a simple baseline of adding Gaussian noise to $c_N$ to show the value of approximating H.\n- Questionable metric choices, as using LAION aesthetic score for Celeb-HQ and VGGFace2 datasets is not well-justified for face images. And images generated from protected model often contain high-frequency and colorful patterns, which may lead to unreliable LAION aesthetic scores.\n- Also evaluation need to include identity score (as used in Anti-DreamBooth) for face datasets, which is crucial to ensure generated images don't contain user's identity.\n- A suggestion would be to add an assessment against recent encoder-based personalized techniques, such as InstantID [2], for a more comprehensive comparison.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer JLDf,\n\nWe are grateful for your constructive criticism and insightful comments on our work. We greatly value your feedback and have made significant improvements based on your suggestions:\n\nQ1: Apply PAP to other methods including AdvDM + PAP/Diff-Protect\n\n> Per your advice, we have conducted further experiments by integrating PAP with AdvDM and Diff-Protect methods, in addition to Anti-DB. Additionally, based on your feedback on metrics, we have also included additional identity metrics such as the detectable face rate (FDFR) and identity score (ISM) in Anti-DB. The consistent performance showcased in **Table R3**, surpassing baselines across metrics, validates PAP as an effective general plug to enhance the robustness of adversarial attack methods with minimal computational cost.\n\n> **Table R3**: Integrating PAP with AdvDM/Diff-Protect on the VGGFace2 dataset.\n| Method| LPIPS($\\uparrow$) | FDFR($\\uparrow$) | ISM($\\downarrow$) | BRISQUE($\\uparrow$) | Time($\\downarrow$) |VRAM($\\downarrow$) |\n|---|---|---|---|---|---|---|\n|AdvDM|0.66|0.58|0.42|31.41|262s|22G|\n|/.+PAP|0.69|0.61|0.40|33.43|270s|22G|\n|Anti-DB|0.69|0.65|0.38|28.95|288s|28G|\n|/.+PAP|**0.70**|**0.67**|**0.34**|35.02|297s| 29G|\n|Diff-Protect|0.66 |0.63|0.44|31.72|191s|16G|\n|/.+PAP|0.69|**0.67**|0.37 |**36.70**|198s|17G|\n|No Defense|0.55|0.05|0.52|25.67|-|-|\n\nQ2: Lacking a simple baseline of adding Gaussian noise to $c_N$ to show the value of approximating H.\n> We have conducted a simple baseline experiment by directly adding Gaussian noise (with variances 1, 5, 10, and 20) to $c_N$ to evaluate the value of approximating H. As shown in the **Table R4**, our proposed PAP method, with variance estimate $\\sigma=H$, achieves the best performance across all metrics. Specifically, it outperforms the second-best method by **3\\%($\\uparrow$), 2\\%($\\uparrow$), 3\\%($\\downarrow$), 2.27($\\uparrow$)** on LPIPS, FDFR, ISM, BRISQUE metrics.\nThese findings underscore the necessity of the estimation of variance $H$, to generate more effective adversarial perturbations.\n\n> **Table R4**: Simple Baseline of Adding Gaussian Noise to $c_N$ on VGGFace2 datasets\nVariance | LPIPS($\\uparrow$)|FDFR($\\uparrow$)|ISM($\\downarrow$)|BRISQUE($\\uparrow$)\n---|--- |---| ---|---\n1 |0.67|0.64|0.38|31.92\n5 | 0.67 | 0.65 | 0.38 |32.75\n10 | 0.66 | 0.62 |0.40 |29.21\n20 | 0.64 | 0.60 |0.44|27.01\n$H$ | **0.70**| **0.67**|**0.34** | **35.02**\n\nQ3: Evaluation need to include identity score for face datasets\n> In **Table R3**, we have added the calculation of the detectable face rate (FDFR) and identity score (ISM). In both of these metrics, method + PAP continues to significantly outperform the method itself, including the recent method Diff-Protect.\n\nQ4: Sensitivity to the initial prompt\n> In **Table R5**, we present the outcomes when $c_0=$\"\", showcasing a significant decline in performance compared to the original PAP. This is attributed to:\na) $c_0$ serves as a crucial initialization prior for estimating $c_N$, facilitating rapid iteration (only 20 steps) to achieve a reliable approximation of $c_N$;\nb) $c_0$ is involved in the modeling of H estimation. The approximate expression for H estimation is based on the Taylor expansion modeling of $c_0$ and $c_N$.\n\n> **Table R5**: Results with $c_0=$\"\"\nDataset | FID($\\uparrow$)|CLIP-I($\\downarrow$)|LPIPS($\\uparrow$)|LAION($\\downarrow$)|BRISQUE($\\uparrow$)|CLIP($\\downarrow$)\n---|---|---|---|---|---|---|\nCeleb-HQ|154.57| 0.72|0.50|5.83|30.18|0.32\nVGGFace2|232.34|0.61|0.60|5.65|29.20|0.29\nWikiart |320.79|0.69|0.71|5.72|31.88|0.30\n\nQ5: Inconsistency between pseudo code and implementation\n> Initially, we recalibrated the prompt distribution model for each iteration, as reflected in the supplementary material code. Subsequently, we optimized this process and derived the algorithm in the paper, with all experimental results based on this improved algorithm. We intend to upload the code for the current version soon.\n\nQ6: Table 4 in the paper need to have metrics such as FID, LPIPS to be more comprehensive\n> Per your advice, we have supplemented the evaluation with results for FID, CLIP-I, and LPIPS metrics to provide a more comprehensive assessment, as shown in **Table R6**. \n\n> **Table R6**: Performance comparison after applying DiffPure\n|       | FID(↑)| CLIP-I(↓)| LPIPS(↑)|\n|---|---|---|---|\n| AdvDM+DiffPure|301.22(91.48-)| 0.71(0.06+)| 0.70(**0.06-**)  |\n| Anti-DB+DiffPure|335.94(50.46-)| 0.69(0.04+)| 0.68(**0.06-**)  |\n| IAdvDM+DiffPure|271.02(**118.98-**)| 0.72(0.01+)| 0.68(0.03-)|\n| PAP+DiffPure|**379.60**(68.70-)| **0.64(0.08+)**| **0.72(0.06-)**|\n| No Defense|198.71| 0.77|0.62|\n\nQ7: 4-6 minutues A800 when crafting a set of images is impractical.\n> In **Table R3**, we present the time and VRAM required for each method, including the time required when integrating PAP with other methods. The results demonstrate that PAP introduces an average computation time of processing a set of images (<300s) and memory consumption (<30G). In the future, we aim to further optimize the algorithm to reduce the time to within 4 minutes and lower memory consumption to below 24G, thus enabling the model to be used on the GTX 3090.\n\nQ8: Add an assessment against recent encoder-based personalized techniques, such as InstantID.\n> In Table 3 of our paper, we have demonstrated the results on popular customized models such as LORA, TextInversion, and Dreambooth, effectively illustrating the generalizability of our method across different customized models. However, to further continuously validate the reliability and generalizability of our method, we will include results for the InstantX series (including InstantID, InstantStyle) in our future work.\n\nWe have made an effort to address your questions and have added additional experiments based on your guidance. We look forward to engaging in fruitful discussions with you and welcome any suggestions for improvement. I hope you will consider providing a more favorable evaluation. Thank you.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XWH6LTetrW", "reviewer": "Reviewer_nNzN", "summary": "This paper proposes a novel adversarial training method for text-to-image diffusion models, enhancing robustness against prompt-agnostic attacks. Specifically, the authors utilize prompts (embeddings) from a prompt distribution rather than a specific prompt for adversarial training. The proposed method is evaluated in the contexts of face privacy and artistic style protection.", "questions": "1. Is the proposed protection method robust against adversarial prompts?\n2. Is it possible to demonstrate the connection between the test prompt and the prompt distribution used for training? Alternatively, can sampled embeddings from the prompt distribution be projected into natural language? Such studies would be beneficial for illustrating that the constructed prompt distribution adequately covers potential user prompts.", "limitations": "The authors discussed the limitations in Appendix H.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper aims to bridge the gap between prompt-specific protection and prompt-agnostic protection, which is essential for text-to-image diffusion models.\n2. The proposed method is principled and effective.\n3. The empirical evaluation is comprehensive and convincing.", "weaknesses": "See Questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer nNzN,\n\nWe appreciate the time and effort you put into providing feedback on our work. Your insightful comments have contributed to the enhancement of our paper.\n\nQ1: Demonstrate the connection between the test prompt and the prompt distribution\n> We demonstrate the robustness of PAP against adversarial prompts from two perspectives: \n\n> a) **Theoretical Perspective**:  Unlike previous approaches, we target the entire prompt distribution. Optimizing adversarial perturbations in this manner yields effective results even when faced with unknown prompts, thus achieving a more robust attack effectiveness against different adversarial prompts. Our modeling of prompt distribution is based on Laplace approximation.  Subsequently, we offer a detailed derivation, encompassing the Laplace modeling distribution and introducing two estimators for mean and variance estimation, along with an estimation of upper bounds for errors in Appendix A. A series of derivations demonstrate that our estimations fall within controllable margins.\n\n> b) **Experimental Perspective**:  In the paper, Table 1 showcases the average results of PAP across three datasets with 10 different test prompts each. Figure 2 displays visual representations of the results for different test prompt inputs, while Figure 3 exhibits the outcomes for combined inputs of different test prompts. Table 10 reveals the results of test prompts with other pseudo words used as inputs. Additionally, Appendix I presents further visual results of different training and test prompts. Collectively, these results indicate that PAP is robust against adversarial prompts.\n\nQ2: Connection between the test prompt and the prompt distribution\n>  Thank you very much for your constructive feedback.\nAs emphasized in Appendix H.1, selecting prompt samples that approximate the mean and convey meaningful semantic information is vital for bridging the semantic gap between the estimated prompt distribution and natural language. In our ongoing efforts, we propose a restriction module to discretize the Gaussian distribution, filtering out semantically irrelevant prompts to improve the generation of more meaningful text options, as detailed in Appendix H.\nHowever, we acknowledge the challenge of projecting sampled embeddings from the prompt distribution into natural language in the current version.\nDespite these challenges, we are committed to enhancing visualization. Thus, we visualize the projection of natural language into embeddings to examine its relationship with the modeled prompt distribution. Specifically, in our visual experiment presented in **Figure R2** of the rebuttal.pdf, we reduce the dimensionality of embeddings for $c_N$ and 10 test prompts and utilize **PCA** for visualization. This illustration showcases how the test prompts' principal components are discretely distributed within the modeled prompt distribution, indicating a flexible probability of selection for adversarial attacks. This underscores the **adaptability** of our modeling in encompassing a broad spectrum of natural language inputs in the semantic space.\n\nWe are grateful for your continued support of our work and the invaluable insights you have shared. Your feedback is crucial in refining our efforts, and we truly appreciate your contributions as we endeavor to enhance our work.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "n4zt0LpiQu", "reviewer": "Reviewer_Q3Lh", "summary": "The paper presents Prompt-Agnostic Adversarial Perturbation (PAP), a method to enhance privacy and security in customized text-to-image diffusion models like Stable Diffusion.  These models, while enabling high-quality image synthesis, pose risks of privacy breaches and unauthorized artwork usage.  Existing adversarial methods, limited by their reliance on specific prompts, fail with unseen prompts.  PAP addresses this by modeling the prompt distribution with a Laplace approximation, generating robust perturbations effective against diverse prompts. Experiments on datasets such as VGGFace2 and Wikiart show PAP's superior performance and robustness.  This method provides a significant improvement in protecting images from unauthorized use and manipulation in diffusion models.", "questions": "Please see weakness", "limitations": "N/A", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. I appreciate the idea of designing a prompt-agnostic adversarial perturbation for privacy protection.\n2. The method is concise and paper organization is logical.\n3. The formulas, tables, and figures in the paper are easy to follow.", "weaknesses": "1. Although the motivation for designing a prompt-agnostic adversarial perturbation is reasonable, the method seems too complex. That is, maybe we can expand the prompt with LLM to get a lot of prompts (different scenes) containing the keyword. Then we can use all these prompts together as a set to calculate a gradient for adversarial attack at each iteration.\n2. For definition 3.1, the assumption of Z = p(x0, c0) as a constant lacks evidence.\n\nMinor suggestion:\n\n1.\tFor tables 1, 2, 3, and 4, there are some left parentheses that have no space between the previous metric names.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer Q3Lh,\n\nThank you for your thorough review and constructive feedback. Your perceptive comments and suggestions have helped us improve our work.\n\nQ1: a) PAP seems too complex? b) Simply expand prompts with LLM and gradient ensemble?\n> a) The final implementation of PAP, as presented in **Algorithm 1**, is notably straightforward and exceptionally user-friendly.\nThe pipeline of the entire model involves initially modeling a prompt distribution through Laplace approximation, with the development of two estimators to compute the distribution parameters. Subsequently, Monte Carlo sampling is applied to each input distribution to optimize a disturbance expectation. The expressions for the two estimators are depicted in Equations (9) and (12) in the paper. On this basis, our implementation merely entails sampling attacks on Gaussian distributions with means from Equations (9) and variances from Equation (12), as Reviewer JLDf remarked, **\"PAP is simple and easy to use.\"**\nIn order to further expound on the precision and interpretability of our estimation methods, we rigorously assess the errors between the two estimators and the ground truth, and proceed with deriving upper bounds for these errors in Appendix A. Hyperparameters are meticulously selected to ensure that these error bounds stay within manageable limits. While the derivation of this error assessment may have initially appeared complex, these efforts are aimed at streamlining the final algorithm's implementation. Through above detailed mathematical reasoning, we have arrived at a **concise** algorithm and implementation code outlined in **Algorithm 1**, which stands as a significant highlight of our work.\n\n> b) The approach you mentioned involves expanding the prompt using a Large Language Model (LLM) to generate multiple prompts (different scenes) containing the keyword. Subsequently, all these prompts are utilized collectively as a set to calculate the gradient for the adversarial attack at each iteration. \nThis gradient ensemble approach relies on a crucial **assumption**: through a straightforward ensemble technique like averaging the gradients of loss concerning all $g_i$ during the adversarial attack process, one can obtain an ensembled $g$ that maximizes the overall loss for each prompt. However, this fundamental premise has faced criticism for \"often overlooking the unique attributes of each model, resulting in suboptimal outcomes\" **[1]**, making it challenging to achieve the desired optimal results.\n Contrary to this simple ensemble strategy, by modeling the prompt distribution and conducting targeted attacks based on the probabilistic sampling within the modeled distribution, our method accounts for the **diverse characteristics** of each prompt and their respective influences on the overall attack, thus leading to a more adaptive and effective adversarial strategy.\n\nQ2: The assumption of $Z$ as a constant in definition 3.1\n> In Definition 3.1, $x_0$ represents the given input image, while $c_0$ represents the given descriptive text. Both are given inputs rather than variables, and as such, $Z = p(x_0, c_0)$ is a constant.\n\nQ3: For tables 1, 2, 3, and 4, there are some left parentheses that have no space between the previous metric names.\n> We appreciate your kind reminder. If there are any additional suggestions or concerns, please feel free to share them with us.\n\nWe sincerely appreciate your considerate review and the insightful feedback you provided for our paper. It seems that you have viewed our work favorably, for which we are grateful. Would you kindly consider adjusting the rating to better align with your positive sentiments towards our research? Your understanding and support mean a great deal to us.\n\n[1]An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferability", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear AC and all the reviewers,

We would like to express our sincere gratitude to you for your comprehensive evaluation of our manuscript, as well as your insightful feedback and constructive suggestions.

We have tried our best to answer all questions of the reviewers about our paper. We wander if our responses address all the concerns?

Thanks all !

Meta-review: This paper was reviewed by four experts in the field. The initial scores were Borderline Accept, Borderline Reject, Accept, and Borderline Accept. The rebuttal addressed part of the reviewers' concerns and convinced 2 reviewers to increase their scores, leading to all acceptance recommendations. The reviewers applauded the paper for its well-motivated problem, good writing, simple and easy-to-use technique, extensive and convincing experiments. Based on the reviewers' feedback, the decision is to recommend the paper for acceptance to NeurIPS 2024. The reviewers did raise some valuable concerns that should be addressed in the final camera-ready version of the paper. The authors are encouraged to make the necessary changes to the best of their ability. We congratulate the authors on the acceptance of their paper!
Decision: Accept (poster)