BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
Authors: Jinsu Kim
Yunhun Nam
Minseon Kim
Sangpil Kim
Jongheon Jeong
Venue: NeurIPS 2025 poster ()
Keywords: copyright protection
adversarial examples
text-to-image models
computer vision
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: A surprisingly simple plug-and-play method to strengthen adversarial image protection against diverse purification techniques.

Abstract: Recent advances in text-to-image models have increased the exposure of powerful image editing techniques as a tool, raising concerns about their potential for malicious use. An emerging line of research to address such threats focuses on implanting “protective” adversarial noise into images before their public release, so future attempts to edit them using text-to-image models can be impeded. However, subsequent works have shown that these adversarial noises are often easily “reversed,” e.g., with techniques as simple as JPEG compression, casting doubt on the practicality of the approach. In this paper, we argue that adversarial noise for image protection should not only be imperceptible, as has been a primary focus of prior work, but also irreversible, viz., it should be difficult to detect as noise provided that the original image is hidden. We propose a surprisingly simple method to enhance the robustness of image protection methods against noise reversal techniques. Specifically, it applies an adaptive per-region Gaussian blur on the noise to adjust the overall frequency spectrum. Through extensive experiments, we show that our method consistently improves the per-sample worst-case protection performance of existing methods against a wide range of reversal techniques on diverse image editing scenarios, while also reducing quality degradation due to noise in terms of perceptual metrics. Code is available at https://github.com/jsu-kim/BlurGuard.

BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
Jinsu Kim Yunhun Nam Minseon Kim? Sangpil Kim
Jongheon Jeong'
Korea University Microsoft Research Montréal
{tonmmy222, yh0326) Skorea. ac.kr
Abstract
Recent advances in text-to-image models have increased the exposure of pow- erful image editing techniques as a tool, raising concerns about their potential for malicious use. An emerging line of research address such threats focuses on implanting ("protective") adversarial noise into images before their public re- lease, future attempts edit them using texl-to-image models can be impeded. However, subsequent works have shown that these adversarial noises are often easily "reversed," e.g., with techniques as simple as JPEG compression, casting doubt on the practicality of the approach. In this paper, we argue that adversar- ial noise for image protection should not only be imperceptible, as has been a primary focus of prior work, but also irreversible, viz., it should be difficult to detect as noise provided that the original image hidden. We propose sur- prisingly simple method to enhance the robustness of image protection methods against noise reversal techniques. Specifically, it applies an adaptive per-region Gaussian blur on the noise to adjust the overall frequency spectrum. Through exten- sive experiments, we show that our method consistently improves the per-sample worst-case protection performance of existing methods against wide range of reversal techniques on diverse image editing scenarios, while also reducing qual- ity degradation due noise in terms of perceptual metrics. Code is available at https:/ / / thub. com/ su- kim/ ham//Buururrdd
1 Introduction
Generative AI has been revolutionizing computer vision with its remarkable capabilities in visual synthesis across complex domains, including images [4, 37, 67]. 3D models [16, 52, 70], and videos [8, 69]. Text-to-image models [23, 67, 75), powered by large-scale diffusion-based generative models [33, 73, 85), are one of the representative examples of current generative AI, given the significant interest they have garnered within the research community. For example, these models have facilitated diverse application research, e.g., personalizing the models into specific artistic styles [26, 74], inpainting or editing an image based on textual prompts [55, 58], and even following detailed instructions [7]. to name few. Publicly available text-to-image models, such Stable Diffusion (SD) [23, 67], have further expanded the accessibility these techniques to broader audiences.
Despite advancements, the broader accessibility of text-to- -inage models has also raised serious concerns about their potential for misuse. Specifically, natural-looking manipulation of an image can produce harmful or deceptive content, resulting in fake news, violations of copyright, publicity or even portrait rights. For instance, current models can easily replicate an artist's style without permission or infringe portrait rights by manipulating images of any victims. Such malicious editing is particularly concerning as the quality of image generation approaches level that nearly indistinguishable from reality; this "realism" of generative AI increases the risks of misinformation.
Equal contribution.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Power Bocerial Densly Sturos Parluted
X
Transform
Gouasion Oar
Segment Anything
M
By
F
-20-
Gauaston
OR
022
0.4
Region
Begmented Perturbations
Elured
X
Fourter
Fleuencyy
(o) Bemantic-aware Masking
(b) Adaptive Blurrigg
(e] Power Spactrum Loss
Figure 1: Overview of BlurGuard, a novel framework for constructing robust image protection. We (a) leverage Segment Anything [40] to obtain semantic-awan region-wise perturbations, (b) apply different levels of Gaussian blur, and (c) update blur-intensity parameters to minimize the power-spectrum gap before and after adding the perturbation.
harassment, intellectual property theft, and privacy violations, manipulated images spread false narratives, damage reputations, or exploit individuals without consent.
To mitigate these risks, recent efforts [77, 80, 90, 101] have focused on developing technical strategies raise the cost of malicious image editing, which has been significantly lowered by generative AI. One of the prominent ideas in this direction is to apply adversarial noise [29, 87] to images before they are exposed to potential malicious uses [48, 49, 77, 96), ensuring that the noise (a) imperceptible enough to preserve the original quality of the given image, and (b) capable of completely disrupting the behavior of generative Al. For example, Salman al. [77] have shown that such noise effectively prevent an image from being edited using off shell text-to-image models, such as Stable Diffusion.
However, later studies [34, 102] have raised concerns about the reliability of adversarial attack-based protection methods for practical use. Specifically, they found that all the existing methods are vulnerable to simple noise removal techniques, such as JPEG compression [91] and diffusion-baa based noise purification [63, 66], effectively neutralizing the protections and allowing attackers bypass them. In other words, adversarial image protection is often easily "reversible." These observations suggest that simply finding imperceptible noise is not sufficient techniques. This is intuitively reasonable, imperceptibility is defined by human perception, whereas existing noise removal methods are not necessarily designed to align with humans.
withstanding diverse noise removal
Contributions this paper, we move away from the previous focus on imperceptibility as the primary criterion of crafting adversarial noise. Instead, argue that adversarial noise should also minimally affect the original distribution of images across different representations, ensuring that remains undetectable by detectors based on unforeseen image representations. We start by observing that adversarial attacks optimized for imperceptibility. e.g., by constraining the noise within a small -ball often produce noise that becomes easily detectable when viewed in the frequency spectrum. We develop this observation and show that existing adversarial attack methods for image protection commonly suffer from this issue, explaining why they can be easily bypassed.
To further support our claim, we propose surprisingly simple method that improves the robustness of adversarial attacks against noise removal by minimizing their detectability in the frequency domain. Specifically, we introduce (a) a learnable Gaussian blurring layer to effectively limit the frequency bands of adversarial noise for each semantic region of given image, and (b) novel objective to optimize the blurring parameters based on the power spectrum of the perturbed image (see Figure 1). In this way, the adversarial noise can automatically adjust its frequency bands to maintain high naturalness to withstand purification techniques.
We perform an extensive evaluation of our method in comparison to existing adversarial attack based image protection methods [48, 49, 77, 96], under a challenging scenario where malicious user selects the best-case performance after diverse state-of-tthe-ar noise removal techniques [34, 63, 102]. As an attempt to standardize the evaluation, we also construct a new curated dataset for assessing the performance of image protection techniques against malicious editing, addressing the current lack of

---

public benchmark. Our results show that the proposed method, despite its simplicity. significantly improves the per-sample worst-case protection performance on the benchmark, while effectively controlling its imperceptibility as well. For example, our method could maintain the effectiveness in FII up to 93% after all purification tested, while the previous best does only 48%.
2 Related Work
Protecting images against generative AT The concept of embedding adversarial noise protect images from unauthorized AI systems has been introduced in various contexts [17, 77, 79, 80, 90]. For example, Shan et al. [79] considered scenarios in which "tracker" trains facial recognition model using online photos of specific users, and proposed leveraging adversarial noise to disrupt model training and protect user privacy. Salman al. [77] considered similar threats in the context of text-to-image model based image editing pipelines; Shan et al. [80] and Van Le et al. [90] have focused on a specific setup of style mimicry, where a malicious user further fine-tunes text-to- image model to extract artistic styles in images; Choi et al. [18] have focused on impainting, which modifies specific regions of human images. The robustness of image protection has only recently been explored [15, 92], but existing methods remain limited to handling a single type of editing task (e-g-, inpainting) and are tailored to naïve purification techniques such as JPEG. In this paper, we propose a simple and versatile method that generalizes across a broader range of image editing tasks, with focus on the more challenging scenario of worst-case purification techniques.
Frequency-basee adversarial examples Some early works constrained their adversarial perturba- tions within low-frequency bands for several reasons, including reducing computational cost [31], enhancing robustness [81], and improving imperceptibility [2, 13, 56, 59, 95]. In the context of generative diffusion models, Ahn et al. [1] have recently leveraged the frequency domain to enhance the imperceptibility of adversarial perturbation but they do not focus on the robustness of protection. In image watermarking, Liu et al. [51] have considered influence functions with frequency con- straint to generate adversarial watermarks against personalized diffusion models, showing robustness against simple compression techniques such as JPEG and WebP. Some works [54, 35] considered low-frequency watermarks so that they remain decodable after editing. Beyond these works, we propose a simpler yet versatile frequency-base based approach for robust image protection through a novel power spectrum regularization, targeting wider ranges of tasks and purification methods.
We provide more discussion of related work in Appendix A.I.
3 Preliminaries
Text-to-imee -i-ae diffusion models Diffusiin models [22, 33, 84] learn a data distribution Paata (x) through denoising interpolants between Paat (x) and Gaussian noise. Text-to-image difsusion models [4, 73, 75] incorporate texts as external variables for conditional generation. From architectural perspective, existing large-scale diffusion models typically employ one of two designs to handle high-resolution inputs: (a) latent diffusion models (LDMs) [73]. which first map x into a latent space of lowcrrresolution via an encoder z == {x)), and (b) cascaded diffusion models [76], which first train a low-resolution pixel diffusion model, followed by progressive super-resolution modules.
Adversarial image protection In response the emerging threats of malicious image editing enabled by generative AI, recent efforts [48, 49, 77, 96] have utilized adversarial examples [5, 12, 87] as a protection scheme of images against public generative models, egg., text-to-image diffusion models. In particular, PhotoGuard [77] proposes two different ways of disrupting the inner working of IDMSs (e.g., Stable Diffusson) through adversarial noise: either (a) by corrupting the encoder model within LDM ("encoder attack"), or (b) by making its denoising process more difficult ('diffusion attack"). For example, the encoder attack considers the following optimization given x:
Xadv = arg min Lene (x). where Lene := [[x Zugerl 12
(1)
d(xxx){+
where d(., :) is distance metric, and Zurget is certain target latent representation, e.g., that of gray image. In practice, such an optimization is performed via projected gradient descent (PGD) [57], using a distance metric that allows easy projection while maintaining imperceptibilitt, such as fo
distance d(x x) := ||* x x
x + Proj Proj|xxx||==Se Se (x 7 sign V Lene (x))
(2)
3

---

where y is the siep for each update.
Adversarial purification The idea of neutralizing adversarial noise through adversarial purification methods has been repeatedly explored over time; examples include JPEG compression [30], GAN- based projection [78], and diffusion model-based denoising [63], among others. Yet, later works [3, 45] have shown that these approaches are often insufficient as a thorough defense mechanism. Given the "flipped" attack- defense relationship introduced by the new setup of adversarial protection, however, these purification methods have now become strong "attack" mechanisms [34, 102]; here, the key difference is that adversarial noise (intended for protection) no longer has the opportunity to adapt future purification methods, even if there are ways to bypass individual purification schemes. Ultimately, we question: "Can a single adversarial noise be resilient to all possible purification methods, offering irreversible protection against evolving noise reversal techniques?"
4 Method
In approaching the above question, we argue that irreversible adversarial noise should have only minimal impact on the data likelihood of the original image, so that no specific purification method can project the noise back onto the given manifold defined by Paua (x). We motivate this intuition by showing that existing adversarial protections, even when imperceptible in the pixel space, are often easily detectable when analyzed in their frequency bandwidth, and consequently by purification methods (Section 4. 4)... Based on this observation, we propose BlurGuard, a simple method to enhance robustness of adversarial protection by adaptively restricting the frequency bands of perturbation to align more closely with the natural frequency characteristics of the data, making the noise less distinguishable from the underlying distribution Pduta (x) (Section 4.2 and 4.3).
Threat model Consider a private image x sampled from Pdata (x) (i.e., x initially has a high data likelihood), which is accessible only to a protector (or "defender"). The goal of the protector is to find an adversarial example & near x such that unauthorized editing of x using a given text-to-imas -mage diffusion model (x c) becomes difficult. In order to control the imperceptibility of &, we assume that & is bounded within a certain ball B, (x) around x, where its definition depends on the chosen distance metric d(.,)):
(3) There can be multiple ways for & to disrupt the behavior of po (x,c), e.g., by corrupting either the encoder or denoiser within LDMs, as done in PhotoGuard. We denote the protector's adversarial objective L (x:: po).
(x(x) = fx' x(x'x)) S c).
From the perspective of an unauthorized editor (or "attacker"), on the other hand, the goal is now to neutralize given protected image & by purifying the added adversarial noise, iee. to recover from x. Given the common information that x has high likelihood with respect to Paata existing purification methods essentially leverage specific prior knowledge about Paata and aim to maximize Paatn (x) For example, JPEG compression [91] is designed to remove less-frequent signals natural scenes. In principle, the attacker has no restriction on the choice of purification methods to apply, as long as x remains hidden. This means that, an "oracle" attacker, equipped with a close approximation of Pdata. could even directly maximize Paaa(())
Need for "naturalistic" protection sider the following minimax objective find adversarial protection:
Ultimately, incorporating the attacker's capabilities, we con-
Xady arg min Ladv (purify((x);;)) (x);; where purify(x)) arg max log Pdata (y, c). (x)
(4)
(x)
The objective (4) suggests that the optimal protection & should lie among the points in (x) where the data likelihood is at least Paam (x); otherwise, purify (x) could identify x as a feasible point in the inner optimization, thus succeeding in reversing the protection.
4.1 A Frequency View of Adversarial Image Protection
We next question whether the existing methods for adversarial protection [49, 48, 77, 96) are capable of generating sufficiently natural perturbation, i.e., ones that can effectively solve (4). In general, the

---

naturalness of adversarial examples has been controlled by constraining the noise to meet a certain imperceptibility criterion, e.g., being within a small e--ball; current adversarial protection techniques also follow this approach.
However, pursuing imperceptibility does not neces- sarily ensure naturalness; rather, imperceptibility is a specific instance of naturalness, when perception is limited to human vision. Given that diffusion mod- els reconstruct images by progressively moving from low to high frequencies [72]. it is natural to expect that the seauuuecc--pecrrumm naturalness of an im- age also influences its data likelihood Pauta- In Fig- ure 2, we indeed observe that an imperceptible, 6o- constrained image protection from various existing methods often produces more significant deviation when viewed in its radially-average
Orgirl
Digira
Pee Neawell
20
500
-10
-00
-20
-00
Proceesyy
(a) Attacked images
(b) After purification
power spectral density (RAPSD), making it difficult to consider as a natural scene; e.g,, one that follows the 1- [9].
Figure 2: Comparisons of RAPSD on
ImageNet-Edit (Appendix C.3) with SD-v1.4.
4.2 BlurGuard: Robust Adversarial Protection via Adaptive Gaussian Blurring
Motivated by Section 4.1, we develop BlurGuard, simple plug-and-play approach to improve the robustness of image protection methods by regularizing the power spectrum of adversarial noise. Overall, we generally observe the bias of existing image protection techniques towards high- fighffreuuecyy bands and aim to close this spectrum gap (from natural images) by applying "spatially-adaptivv Gaussian blur the noise. In this way, BlurGuard can selectively allocate high-frequency noise to regions that have less impact on the overall spectrum (e.g., as shown in Figure 2a), thus maintaining strong protection while appearing more natural.
Learnable Gaussian blurring To effectively control the frequency spectrum of image protection, we apply Gaussian blur to adversarial noise with a learnable blur intensity a >> 0. That is, given an input x, start by parameterizing its protection & follows:
x G(6:
where 9 represents the Gaussian blur operation, and a learnable parameter. For image-like inputs, Gaussian blur can be implemented depthwise 2D convolution, 2 where the kernel matrix Ho, E (22++))(2+++1) is defined by:
(u, G(u) G(v) for u, v {-k,..., k), where G(z) 2
exp
2² 2n²
(6)
The convolution in (6) effectively serves as low-pass filter; is equivalent to modulating the Frunfer-transformeedd x by Gaussian function, given that the Fourier transform of Gaussian kernel is again Gaussian. Here, the blur intensity a determines the cut-off frequency. We initialize ;= log as learnable parameters instead of directly optimizing primarily to avoid numerical instability.
Power spectrum regularization Given an image and its protection X, we aim to optimize the blur intensity of Gaussian blur minimize their discrepancy in terms of frequency spectrum. To this end, we apply Fast Fourier Transform (FFT) to both x and X, and compute RAPSD of them. Specifically, for 2D Fourier frequency matrix f Che we first partition the coordinates of f into B bands with respect to the radius from the center; yielding B sets of coordinates (B, /2 Then, RAPSD is defined by a B-dimensional vector, where the b-th entry is the squared magnitude of the FFT coefficients in B5:
RAPSD&(f) = |BB
Σ
f(u, v)
(u,v) E B
'Wit this implementation. one can optimize using conventional automatic differentiation libraries (e.g.. PyTorch), whereas standard implementations often do not support this.
5

---

Source
PhotoGuard
MIST
AdvDM
BlurGuard
Protection
Edited (Unpurited)
Edited
Edited (Purifedd)
Edit prompt
"Foxes playing the snow"
255 Before purification, all protection methods effectively safeguard the images. However, in the worst-case scenario, the baselines often fail to maintain their protection, producing outputs nearly identical to the original edit. In contrast, BlurGuard continues to generate unrealistic images that do not resemble either the source image the generation from it. More qualitative results can be found in Figure 12 in Appendix.
Figure 3: Qualitative comparison of image-to-imade io-iimaee generation results (c 16
Once the frequency matrices and f are obtained from x and &, respectively, we define a new power spectrum regularization follows:
Lireq & x) |log
(A RAPSD(T]
where ||=||00 == max; |2 is the foo norm. By minimizing (8), one ensure that the spectral gaps between x and & are within certain margin for all frequencies. BlurGuard uses this regularization primarily adjust the optimal blur intensity parameter
Per-region adaptation Considering that an image is composed of multiple regions with diverse patterns, is reasonable to divide the image into several semantic regions and apply different blur intensities; so that the overall frequency characteristics of the perturbed image remain better preserved. To achieve this, we leverage Segment Anything Model (SAM) [40], one of recent image segmentation foundation models, to obtain ft binary segmentation masks {Mr) ) out of a given image Next, we introduce per-region blur intensity parameters )r>) and they are jointly optimized through the following aggregation combined with [M,) (O is the Hadamard product):
R
x
M. o G():o,).
(9)
4.3 Overall Objective
Given image BlurGuard jointly optimizes the perturbation parameters ò and blur intensities := {or) and returns the resulting protection & defined as (9). To optimize we combine our proposed power spectrum regularization Liteq (8) with existing adversarial protection objective, say Ladv. given a certain adversarial budget; here, we consider an c-ball in foo distance, following standard practice:
8 arg min Ladv (xx x) + Litey (xx, (x),))
(10)
|1 Sc.
where À > 0 is hyperparameter." We use iterative optimization (viz., PGD) for solving (10). A slight modification (2) is that we do not apply sign(-) for projecting gradients; instead, we simply use fz-normalization. This is to reduce gradient noise that can arise from sign-based projection, given that the blurring operation already alters the original gradient direction.
We average over the channels before applying FFT on &, ensuring that their frequency matrices remain two-dimensional.
We fix x 10 throughout all the experiments this paper.

---

In terms of o, on the other hand, we observe that optimizing a for Ladv can be in conflict with Liee causing converge to a looser frequency band and thereby affecting robustness. As a simple remedy, we first optimize with respect to the power spectrum objective only, i.e, for minimizing Trrry X, x), and freeze the learned throughout the optimization of ó as in (10). The detailed procedure is provided in Algorithm in the Appendix.
Adversarial objective In principle, our proposed adaptive blurring scheme is versatile and compat- ible with any form of adversarial objective Lady that aims to protect an image from being edited. In our experiments, we adopt the encoder loss Teen of PhotoGuard (1), primarily for simplicity. Here, take aageet 0, also following Salman al. [77]-
Experiments
To verify the effectiveness of BlurGuard, perform extensive evaluation covering wide AI- powered editing scenarios, including image-to-image generation [73], inpainting-basee editing [55], instruction-based editing [7]. textual inversion [26], and DreamBooth [74]. We compare various protection methods applicable to editing tasks, considering a fixed -bal of 255 as the adversarial budget following the standard. Our evaluation covers both (a) naturalness: how imperceptible the protection is, and (b) effectivenes:: how much a protected image can deviate from the original image when both are edited. The detailed experimental setups, e.g., datasets, baselines, evaluation metrics, hyperparameters, etc., can be found in Appendix C.
Id
Purification methods To assess the robustness of each protection method, we consider diverse noise purification techniques, including: (a) JPEG compression, (b) JPEG followed by image upscaling [62], and (c) Noisy upscaling [34), which combines Gaussian noise and upscaling for more aggressive purification. More advanced diffusion-based purification methods also considered; including (d) Impress [10]. (e) DiftPure [63], (f) GrIDPure [102], and (g) PDM-Pure [94]. Details on purification methods can be found in Appendix C.5.
Worst-case effectiveness Unless otherwise noted, we mainly focus on per-sample worst-case effectiveness of image protection methods, which compute the "lowest" performance scores after applying all the purification techniques available (i.e., from (a) to (g)) individually for each sample. This comparison assumes an "oracle" attacker equipped with many noise purification techniques. which is essentially closer to more realistic threats.
5.1 Results
Image-to-image generation We test BlurGuard for image-to-image editing based on Stable Dif- fusion (SD) v1.4 model [73], following previous setups. 6 To effectively evaluate image protection performance across diverse cases, we have curated a new, custom subset 80 image samples taken from ImageNet [21], coined EmageNet-Edit; more details can be found in Appendix C.3.
Table summarizes the results. Overall, we observe that BlurGuard consistently surpasses the baselines tested across all metrics, both in naturalness (up to 30% reduction in LPIPS) and in worst- case robustness (up to 9.8% increase in FID). This observation further supported qualitatively in Figure la.. We also remark the high variance of BlurGuard in PSNR naturalness; this is due to that BlurGuard assigns an adaptive amount of perturbation per-image to achieve high naturalness, which is an expected behavior.
In Table 3, we compare the ratio of effectiveness in FID before and after purification. Notably, BlurGuard retains 92.9% of its original protective efficacy even after purification; far surpassing all other methods, which fall between 38.5% and 48.4%. This confirms the superior robustness of BlurGuard to existing purification approaches.
Inpainting Inpainting-bast based editing incorporates a binary mask information as well as a textual prompt, which can be useful for modifying specific regions (e.g., the surrounding environment or
'We report the textual inversion and DreamBooth experiments Appendix D.I. We also provide results with SD-v2.1, SD-v3.5, and FLUX.I-dev models in Appendix D.3.
7

---

IN-Edit (c 263
Naturalness
Worst-case Effectiveness
Method
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNR
IA
PhotoGuard 1771
0.34 0.11
0.10
28.2 0.32
92.21
0.27
0.07
0.13
29.9 1.07
0.94 0.04
AdvDM (19)
0.16
0.09
0.29
98.27
0.30 0.08
30.2 0.03
0.93 0.04
Mist (18]
0.11
0.12
0.26
90.96
0.71 0.30 0.07
0.93 0.86
SDS (96]
0.30 +
0.79
0.45
91:48
0.26 0.26 0.07
0.73
30.3 1.23
0.91 0.01
BlurGuard (Ours)
0.21 0.10
0.93 + 0.09
31.1 2.29
107.88
0.32 0.09
0.70
:: 0.09
28.8 0.42
0.92 0.05
(a) Image-to-image generation
Helen
Naturalness
Worst-case Effectiveness
Method
LPIPS 1
SSIM
PSNR
FID
LPIPS
SSIM
PSNR 1
IA
PhotoGuard (77)
0.10 + 0.05
0.91 + 0.04
35.4 + 1.71
131.93
0.34
0.89 + 0.08
29.5
0.93 = 0.04
AdvDM [19]
0.06 + 0.04
0.97
40.4 0.02
105.26
0.07
0.76 + 0.08
0.70
0.95 0.03
Mist [+8]
0.07 +: 0.04
0.95
4: 0.02
37.3 1.62
109.37
0.27 4: 0.07
0.74 4: 0.07
29.9 4: 0.52
0.95 0.03
SDS (66]
0.16 + 0.07
0.92
+ 0.04
35.4 + 1.75
133.78
0.34
0.69 0.08
29.6 4 0.60
0.92 0.03
DiffusionGuard (18)
0.09 + 0.05
0.94 + 0.03
36.6
+: 1.64
123.32
0.32 = 0.08
0.71 + 0.08
29.7 + 0.54
0.93 = 0.04
BlurGuard (Ours)
0.11 + 0.05
0.97 + 0.02
36.5 1: 2.66
162.92
0.45
0.09
0.64 1: 0.09
29.0 0.45
0.86 0.05
(b) Inpainting
MagicBrush (c
16
Naturalness
Worst-case Effectiveness
Method
LPIPS |
SSIM 1
PSNR
FID:
LPIPS
SSIM
PSNR
IA
PhotoGuard (77)
0.19 1 0.10
0.74 1 0.09
31.1 1 0.22
96.23
0.21 1: 0.09
0.73
0.11
30.7 1 1,50
0.96 J. 0.03
AdvDM [-9]
0.27 0.08
0.76
28.9 0.21
123.39
0.30 0.09
0.67
: 0.13
30.2
0.93 + 0.04
Mist (48)
0.09
28.6 0.08
123.54
0.30 = 0.09
0.66 + 0.12
29.8
0.93 + 0.04
SDS 196]
0.20
0.07
29.1 0.37
115.23
0.27 = 0.09
0.68
= 0.13
30.3 1.35
0.91 + 0.04
EdinShield (15)
0.36 0:0:::00 0.13
0.75
375:::00 0.09
31.0
0.21
120.13
0.33
0.09
0.65 0.13
29.9 1.26
GlurG (Ours)
0.20 0.08 0.89 1: 0.07
30.1 1 1.76 138.22 0.36 0.10 0.64 0.12
28.8 1 0.55
0.90 1 0.06
(c) Instruction based editing
Table 1: Comparisons of image protection within -bals of how much protected image deviates from the original. Worst-case effectiveness measured after applying all purification methods to the protected image. The best is highlighted in bold, while the second-bes in underlined.
255 Naturalness indicates
16
IGBench (s
Naturalness
Worst-case Effect. (Seen)
Worst-case Effect. (Unseen)
255
Method
LPIPS
SSIM f
FID
PSNR
FID
PSNR
PhotoGuard 177)
0.03 + 0.02
0.96 + 0.02
103.83
37.2 + 14.2
67 05.05
35.5 1 8.2
AdvDM [49]
0.03 + 0.02
0.97 + 0.02
125.66
35.3 + 10.3
71.06
35.4 + 7.0
Mist Je8t
0.02 + 0.01
0.98 0.01
112.23
37.1 + 14.2
58.48
36.4 + 9.8
SDS [96]
0.05 1 0.03
0.96 00010000 0.02
113.30
37.1 + 14.2
83.91
35.6 1 7.2
DiffusionGuard (18)
0.03 1 0.02
0.97 1 0.02
134.25
37.1 + 14.2
61.32
35.9 1: 9.9
BlurGuard (Ours)
0.03 + 0.02
0.99 + 0.01
140.82
34.9
1: 17.0
90.32
35.3 + 8.9
Table 2: Comparison of image protection for inpainting under mask variability. We test our method on InpaintGuardBench (IGBench) [18] that provides unseen shapes of mask not exposed during each protection phase. The best is highlighted in bold, while the second-ber in underlined.
objects) while preserving others (e.g., a person's is face) Consequently, image protections should be confined to the facial region rather than applied to the entire image, and follow this setup. For evaluation, we use the Helen dataset [44], following Cao et al. [10].
As reported in Table 1, BlurGuard again achieves the strongest worst-case effectiivnees, while maintaining high naturalness; for example, under the same c = 255 budget, BlurGuard finds perturbations that achieve 0.45 LPIPS average in terms of worst-case effectiveness, which is 32.3% higher than the second-best -bett baseline. Qualitative results can be found in Appendix E.
16
To further evaluate the effectiveness of BlurGuard in realistic inpainting scenarios with diverse editing masks, we assess its robustness under mask variability using the InpaintGuardBench [18]. Each image is tested with six masks, including both "seen" (used for protection) and "unscen" (novel) ones.
8

---

2ss
Purified??
Robustness
Method
FID
LPIPS
SSIM
Method
((A)
/ (8)
(B/A; %)
PhotoGuard
134.0
0.36
0.66
0a
PhoooGrard
202.0
92.2
45.6
Ad-DM
150.8
0.40
0.69
uz-
Mist
AdvDM
233.7
258.6
91.0
98.3
38.9
38.5
Mist
147.2
0.40
0.68
SDS
142.6
0.36
0.68
0.-
BlueGuard
116.2 107.9
92.9
BhurGuard
153.1
0.41
0.62
0.25
2,72
0.100
0:10 6.155 5.00
Protecton Natura neaa (LPIS))
Table 3: Comparison of pro- tection effectiveness in FID before and after purification on ImageNet-Edit. Best re- sult is marked bold.
Table 4: Results of black-box image-to-image on ImageNet- Edit (SD-v + SD-v2.1). We 16 in Ex.. Best result 255 is marked in bold.
Figure 4: Comparison of protection naturalness vs. worst-case effective- ness (both in LPIPS) across different protection methods.
use
IN-Edit (s
Naturalness
Worst-case Effectiveness
Method
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNR
TA
AdvDM (o9)
0.36++ 0.12
0.74 0.09
96.27
0.30
0.08
0.73 0.00
30.2 1.17
0.93
0.04
BlurGaurd
0.25 1 0.07
0.81 0.09
30.1
2.19
101.84
0.35
0.09
0.70 1 0.09
28.2.1.2.00
0.93
0.05
Mist
0.35 + 0.12
0.72 = 0.10
28.6
0.25
90.96
0.30 = 0.07
0.71 0.09
0.86
0.93 = 0.04
BlurGuard
0.33
0.86 0.08
32.3
2:21
137.9
0.42 0.10
0.63 0.07
28.8 0.47
0.89 0.06
Table 5: BlurGuard combined with other adversarial objectives, viz., AdvDM and Mist, on ImageNet- Edit. We consider Loo protections within e
16
255
As shown in Table 2, BlurGuard consistently maintains strong protection across these variations, demonstrating robustness to practical editing conditions.
Instruction-basel editing We also evaluate BlurGuard on instruction-based editing scenarios, focusing InstructPix2Pix [7]: a fine-tuned diffusion model specifically to follow natural-language editing instructions. We use MagicBrush [98] dataset for the evaluation. As shown in Table Ic, BlurGuard shows superior worst-case protection effectiveness across all proposed metrics, while maintaining high imperceptibility competitive to the best baseline.
Naturalness vs. robustness Figure compares how the worst-case gap (measured by LPIPS) varies with the naturalness of each protection method (also measured by LPIPS) on image-to-ine to-image generation. Here, we define the worst-case gap as the degradation in protection effectiveness under the strongest purification method. To this end, we construct a histogram of pairs of these two LPIPS values for each method, drawing samples by varying the adversarial budget from 255 to 16 The results reveal that, unlike other methods that suffer from significant performance degradation after purification, BlurGuard consistently maintains nearly zero performance gap across all LPIPS levels.
255
Black-box transfer We further evaluate BlurGuard on black-box transfer. Specifically, we test image protections optimized from SD-v 1.4 to other models; here we consider SD-v2.1. Results in Table 4 show that BlurGuard maintains its effectiveness in black-box setup well, suggesting that adversarial noise in controlled frequency regime generalizes more effectively across models. Qualitative results can be found in Figure 13 in Appendix. We also test SD-v3.5, FLUX.1-dev [43], and a GAN-based SimSwap [14] as additional target models, as reported in Appendix D.2.
BlurGuard with other adversarial objectives To demonstrate that BlurGuard operates in simple plug-and-pa and-p manner, test its compatibility with other adversarial objectives: AdvDM [49], which directly maximizes the denoising loss, and Mist [48], which jointly attacks the encoder and denoiser. As shown in Table 5, BlurGuard consistently enhances both naturalness and worst-case effectiveness across these objectives, demonstrating its broad applicability to diverse protection frameworks.
5.2 Ablation study
We perform ablation study to validate the effectiveness of the individual components in BlurGuard. Throughout this study, we consider image-to-image generation tasks using SD-v1.4 .4 with Additional ablation studies can be found in Appendix D.4.
16.
255

---

Naturalness
Worst-cuse Effect.
SSIM
LPIPS
Method
Inference Time (s)
BlurGuard
0.93 0:09
31.1 a 2.29
0.32 0.09
107.88
PhotoGuard
8.836 1 0.005
w/o Adaptive blurring
Mist
31.267 + 0.044
0.0 (const.)
0.53 0.14
92.9 2.49
0.19
019=0.0 0.07
65.94
AdvDM
31.103 + 0,008
(const.)
0.59
0.22
SDS
12.493 + 0.016
(const.)
0:17
31.6
0.31
0.14
BlurGuard
31.071 + 0.012
w/o Per-region masks
0.94
0.09
0.09
2:511
0.20 = 0.09
06.57
Semantic masking
3.019 1 0.001
w/o Spectrum reg. LA = 0.0)
Adaptive blurring
5.367 1: 0.002
learned
0.12
0.40
113.97
learned o
20
D.06
320
0.19 0.04
28.57
PGD updates
22.685 1: 0.010
0.0
0.70
28.
0.32
0.27 0.07
92.11
Table 7: Comparison of inference time (in seconds) measured on single NVIDIA A100 (80GB) instance.
Table 6: Ablation study on BlurGuard. By default, we
consider the lo constraint within 255
Adaptive blurring To validate the effectiveness of our learnable Gaussian blur scheme, we compare BlurGuard with ablations where the blur intensity a are all fixed as constant throughout optimizing Specifically, we test O, 0.5, and 1.0. The results in Table 6 ("w/o Adaptive blurring") confirm that our adaptive o provides more effective protection by better aligning the frequency bands of the perturbation with the image. The significantly low SSIMs observed from the fixed-o configurations, despite their high PSNR scores, indicate that constant blurring often degrade image likelihood even when the perturbation magnitude is low. For example, fixed blurring may fail to account for textural characteristics of given image, leading to both unnatural and weak protection.
Semantic-aware masks Next, we evaluate how our per-region blurring mechanism enhances BlurGuard, compared to its ablation ("w'o Per-region masks") that learns single for the entire image. Table 6 shows that the per-region approach provides higher protection effectiveness in worst- case scenarios, while being competitive in naturalness. This indicates that robust protection benefits from varying blurring intensities for different image regions depending on their frequency spectrum.
Power spectrum regularization We test two ablations for proposed power spectrum regulariza- tion: (a) À = while learning a during the first training stage, and (b) those even without o, which is essentially equivalent to PhotoGuard (1) in this experiment. Overall, we observe that spectrum regularization plays a crucial role in preserving naturalness; although the adaptive blurring scheme already enhances worst-case effectiveness, compromises naturalness without the regularization as the adversarial objective Lad in (10) alters the frequency spectrum. For example, the "learned G. 255 ablation yields far weaker worst-case effectiveness than BlurGuard while it maintains similar imperceptibility metrics. These results demonstrate that the spectrum regularization we propose induces more effective protection without sacrificing visual imperceptibility.
Computational overhead We report the computational overhead caused by each component of BlurGuard by measuring per-sample inference time (on a single NVIDIA A100 80GB GPU instance) as shown in Table 7. Overall, we observe that BlurGuard introduces overhead no greater than existing methods such as Mist and AdvDM, with the proposed adaptive blurring and semantic-aware masking pipeline accounting for only small portion of the total time.
6 Conclusion
We introduce BlurGuard, a simple-yet-effective framework designed to protect images from unautho- rized editing via generative models. BlurGuard tackles the current challenge of protection methods against purification by crafting adversarial noise that remains closer to in-distribution. We conduct extensive experiments to validate the effectiveness of BlurGuard, even introducing an "oracle" at- tacker equipped with the strongest purification among diverse options. The results consistently show that BlurGuard enhances robustness against existing purification methods, highlighting the potential of adversarial examples with naturalness as promising direction for future research.
10

---

Acknowledgements
This work was supported by the Institute Information & Communications Technology Planning Evaluation (IITP) grants funded by the Korea government (MSIT) (No. RS-2019-11190077 Artifi- cial Intelligence Graduate School Program (Korea University); No. IITP-2025-RS, 20125--S-2025-0222 2025-02304828,, Artificial Intelligence Star Fellowship Support Program to Nurture the Best Talents; No. IITP- 2224-44044044 Information Technology Research Center (ITRC)), the National Research Foundation of Korea (NRF) grant funded by the Korea government (MSIT) (No.
and the Korea Creative Content Agency grant funded by the Ministry Culture, Sports and Tourism (No. RS-2025-00345025)
References
[1] Namhyuk Ahn, Wonhyuk Ahn, KiYoo Yoo, Daesik Kim, and Seung-Hun Nam. Imperceptible protection against style imitation from diffusion models. arXiv preprint arXiv:2403.19254 2024.
[2] Namhyuk Ahn, Yoon Yoo, Wonhyuk Ahn, Daesik Kim, and Beung-Hun Nam. Nearly zero-cost protection against mimicry by personalized diffusion models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025. URL https://arxtie org/ aws//aa2..... 11423.
[3] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Leurning, volume 80 of Proceedings of Machine Learning Research, pages 274-283. PMLR, 10-15 Jul 2018. URL attps://ppoot pttps://prroeeedings mlr. www.ppeesssveeeee //00//0aaa0ee1aaa.... html.
[4] James Betker, Gabriel Goh, Li Jing, Tim Brooks, Jianfeng Wang, Linjie Li, Long Ouyang, Juntang Zhuang, Joyce Lee, Yufei Guo, al. Improving image generation with better captions, 2023. URL https: cdn. openai com/ wwwccoom//eeeeeeeee papers/ dall- e- 3..3..pp. p.f...
[5] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šrndić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, pages 387-402. Springer, 2013.
[6] Nicolo Bonettini, Edoardo Daniele Cannas, Sara Mandelli, Luca Bondi, Paolo Bestagini, and Stefano Tubaro. Video face manipulation detection through ensemble of CNNs. In 25th International Conference on Pattern Recognition, pages 5012-5019. IEEE, 2020.
[7] Tim Brooks, Aleksander Holynski, and Alexei A Efros. InstructPix2Pix: Learning to follow image editing instructions. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognition, pages 18392-18402, 2023.
[8] Tim Brooks, Bill Peebles. Connor Holmes, Will DePue, Yufei Guo, Li Jing, David Schnurr, Joe Taylor, Troy Luhman, Eric Luhman, Clarence Ng, Ricky Wang, and Aditya Ramesh. Video generation models as world simulators. OpenAl Blog, 2024.
[9] Geoffrre J Burton and Ian R Moorhead. Color and spatial structure in natural scenes. Applied Optics, 26(1):157-170, 1987.
[10] Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. Impress: Evaluating the resilience of imperceptible perturbations against unauthorized data usage in diffusion-based generative AI. Advances in Neural Information Processing Systems, 36: 10657-10677. 2023.
[11] Qiong Cao, Li Shen, Weidi Xie, Omkar M. Parkhi, and Andrew Zisserman. Vggface2: dataset for recognising faces across pose and age. In Proceedings of the IEEE Conference on Automatic Face and Gesture Recognition, 2018. URL 08092.
17100
11

---

[12] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39-57. IEEE, 2017.
[13] Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(2)99119977, 2025, doi: 10.1 10//TPAAM..22244448555599
[14] Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. Simswap: efficient framework for high fidelity face swapping. In Proceedings of the 28th ACM international conference on multimedia, pages 2003-2011, 2020.
[15] Ruoxi Chen, Haibo Jin, Yixin Liu, Jinyin Chen, Haohan Wang, and Lichao Sun, Editshield: Protecting unauthorized image editing by instruction-guii diffusion models. In European Conference on Computer Vision, pages 126-142. Springer, 2024.
[16] Zilong Chen, Feng Wang, Yikai Wang, and Huaping Liu. Text-to-3e 3d using gaussian splatting. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 21401-21412, 2024.
[17] Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John P Dickerson, Gavin Taylor, and Tom Goldstein. LowKey: Leveraging adversarial attacks to protect social media users from facial recognition. In International Conference on Learning Representations, wwt.teeeeeeooo htt///orrmmmddde id-..ittoo..oee.....
2021. URL https:
[18] June Suk Choi, Kyungmin Lee, Jongheon Jeong, Saining Xie, Jinwoo Shin, and Kimin Lee. DiffusionGuard: A robust defense against malicious diffusion-basee image editing, arXiv preprint arXiv:2410.05694 2024.
[19] Yujin Choi, Jinseong Park, Hoki Kim, Jaewook Lee, and Saerom Park. Fair sampling in diffusion models through switching mechanism. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21995- 20995,2000, 2024.
[20] Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun, Yue Xing, and Jiliang Tang. DiffusionShield: A watermark for copyright protection against generative diffusion models. arXiv preprint arXiv:2306.0mm 04642, 2023.
[21] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large- scale hierarchical image datahase. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 248-255, 2009, doi: 10. (CCCVPRR.009952066.44
[22] Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
[23] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow transform- ers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning, 2024.
[24] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466 224776,2277,-- 2023.
[25] Felix Friedrich, Manuel Brack, Lukas Struppek, Dominik Hintersdorf, Patrick Schramowski. Sasha Luccioni, and Kristian Kersting. Fair diffusion: Instructing text-to-image generation models on fairness. arXiv preprint arXiv:2302.. 10893, 2023.
[26] Rinon Gal. Yuval Alaluf, Yuval Atzmon, Or Patashnik. Amit Haim Bermano, Gal Chechik, and Daniel Cohen-or. An image is worth one word: Personalizing text-to-image generation using textual inversion. In The Eleventh International Conference on Learning Representations, 2023. URL http:p/:///operreviveeeeee//rrne
[27] Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman and David Bau. Erasing concepts from diffusion models. Proceedings of the IEFF/CVE International Conference Computer Vision, pages 2426-2436, 2023.
12

---

[28] Rohit Gandikota, Hadas Orgad, Yonatan Belinkov, Joanna Materzyúska, and David Bau. Uni- fied concept editing in diffusion models. In Proceedings of the IEEE/CVF Winter Conference Applications of Computer Vision, pages 5111-5120, 2024.
[29] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy, Explaining and harnessing adversarial examples, 2015. URL httph:t/t///aae org/ 0ts//411..572.
[30] Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018. URL httpst:://pperrriiiiieeee http://paaarreeeaa...eerrrrtaa/s
[31] Chuan Guo, Jared S. Frank, and Kilian Q. Weinberger. Low frequency adversarial perturbation, 2019. URL https::////// /ttp:v:://///vv/a/ wwwp:////aaaaaaaeeao/aooeee abs/1809..11
1809. 08758.
[32] Alvin Heng and Harold Soh. Selective amnesia: continual learning approach to forgetting in deep generative models. Advances in Neural Information Processing Systems, 36, 2024.
[33] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-668 6851, 2020.
[34] Robert Hönig, Javier Rando, Nicholas Carlini, and Florian Tramèr. Adversarial perturbations cannot reliably protect artists from generative AI. ICML GenAl and Law workshop, 2024.
[35] Runyi Hu, Jie Zhang. Ting Xu, Jiwei Li, and Tianwei Zhang. Robust-wide: Robust watermark- ing against -rrieen image editing. In European Conference on Computer Vision, pages 20-37. Springer, 2025.
[36] Guillaume Jeanneret, Loic Simon, and Frédéric Jurie. Adversarial counterfactual visual explanations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16425-16435, 2023.
[37] Minguk Kang, Jun Zhu, Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park. Scaling up GANs for text-to-image synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pallern Recognition, pages 10124-10134, 2023.
[38] Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- generative models. Advances in Neural Information Processing Systems, 35: 26565-26577, 2022.
[39] Jaehyung Kim, Jongheon Jeong, and Jinwoo Shin. M2m: Imbalanced classification via major- to-minor translation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13896-13900 2020.
[40] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Lo, et al. Segment anything. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 4015-4026, 2023.
[41] Pavel Korshunov and Sébastien Marcel. Deepfakes: A new threat to face recognition? assessment and detection. arXiv preprint arXiv:1812.0888 18121881228.... 2018.
[42] Nupur Kumari, Bingliang Zhang, Sheng-Yre Yu Wang, Eli Shechtman, Richard Zhang, and Jun-Yan Zhu. Ablating concepts in text-to-image diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22691-22703 2023.
[43] Black Forest Labs, Stephen Batifol, Andreas Blattmann, Frederic Boesel, Saksham Consul, Cyril Diagne, Tim Dockhorn, Jack English, Zion English, Patrick Esser, Sumith Kulal, Kyle Laccy, Yam Levi, Cheng Li, Dominik Lorenz, Jonas Müller, Dustin Podell, Robin Rombach, Harry Saini, Axel Sauer, and Luke Smith. Flux. I kontext: Flow matching for in-context image generation and editing in latent space, 2025. URL https: / //a//aaaa //axxiivvvva./////// org/ abs/ abs//50s/5 /5744.
[44] Vuong Le, Jonathan Brandt, Zhe Lin, Lubomir Bourdey, and Thomas S Huang. Interactive facial feature localization. In Computer UisionFECVV 2012: 12th European Conference on Computer Vision, Florence, Italy, October 7-13, 2012, Proceedings, Part 12, pages 679-692. Springer, 2012.
13

---

[45] Minjong Lee and Dongwoo Kim. Robust evaluation of iuffusion-based adversarial purification. In Proceedings the IEEE/CVF International Conference on Computer Vision, pages 134-144, 2023.
[46] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. BLIP-2: Bootstrapping language- image pre-training with frozen image encoders and large language models. In International Conference on Machine Learning, pages 19730-19742. PMLR, 2023.
[47] Yuezun Li, Xin Yang, Pu Sun, Honggang Qi. and Siwei Lyu. Celeb-df: A large-scale challenging dataset for deepfake forensics. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3207-3216, 2020.
the
[48] Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv: 12683, 2023.
[49] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples. In International Conference on Machine Learning, pages 20763-20788 PMLR, 2023.
[50] Li Lin, Xinan He, Yan Ju, Xin Wang, Feng Ding, and Shu Hu. Preserving faimess generaliza- tion in deepfake detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16815-16825, 2024.
[51] Hanwen Liu, Zhicheng Sun, and Yadong Mu. Countering personalized text-to-image genera- tion with influence watermarks. In Proceedings of the IÉEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12257-1226,, 2024.
[52] Ruoshi Liu, Rundi Wu, Basile Van Hoorick, Pavel Tokmakov, Sergey Zakharov, and Carl Vondrick.
Zero-shot one image to 3d object. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 9298-9309 2023.
[53] Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. DPM- Solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arXiv:2211.01095, 2022.
[54] Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wii-Kin Kong. Robust water- marking using generative priors against image editing: From benchmarking to advances. arXiv preprint arXiv:2410.18775 2024.
[55] Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1 11461- 11471, 2022.
[56] Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jinheng Xie, and Linlin Shen. Frequency- driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15315-15324, 2022.
[57] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. URL https: /ttp::///p///////eee net.ieewweeeeeeeeeeeeee pepet/ffrummmidde JZIBZZAD.
[58] Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. SDEdit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Representations, 2022.
[59] Xiaoyue Mi, Fan Tang, Juan Cao, Peng Li, and Yang Liu. Visual-friendly concept protection via selective adversarial perturbations. CoRR, abs/2408. 085488 2024. URL. htttps://aol org/ 10. 48550/ arxvv. 2408 08518.
[60] Rui Min, Sen Li, Hongyang Chen, and Minhao Cheng. A watermark-conditiones diffusion model for IP protection. In European Conference on Computer Vision, pages 104-120. Springer, 2024.
14

---

[61] Yisroel Mirsky and Wenke Lee. The creation and detection of deepfakes: A survey, ACM Computing Surveys (CSUR), 54(1):1-41, 2021.
[62] Aamir Mustafa, Salman H. Khan, Munawar Hayat, Jianbing Shen, and Ling Shao. Image super- resolution a defense against adversarial attacks. IEEE Transactions Image Processing, 29:1711-1724, 2020. ISSN 1941-0042, doi: 10.11099ip.20112944033. URL http: doi. org/10. 10. 1109/1101T TIP 2019. 2940533.
[63] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In Kamalika Chaudhuri, Ste- fanie Jegelka, Le Song. Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceed- ings of the 39th International Conference on Machine Learning, volume 162 of Proceed- ings of Machine Learning Research, pages 16805-16827. PMLR, 17-23 Jul 2022. URI. https:/ https://prroeeeingss mlr. http//v122nnne//// html.
[64] Takuto Onikubo and Yusuke Matsui. High-FFrquency Anti- Dnti-Dreamboot: Robust defense against personalized image synthesis. In ECCV 2024 Workshop The Dark Side of Generative Aly and Beyond, 2024.
[65]
OpenAL. GPT-4o system card, 2024. URL https://arxiv htttp://aarai..orrr/b///44-0--.
[66] Sen Peng, Mingyue Wang. Jianfei He, Jijia Yang, and Xiaohua Jia. Cat: Contrastive adversarial training for evaluating the robustness of protective perturbations in latent diffusion models. arXiv preprint WxXiv:2502.0722: 2025.
[67] Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. SDXL: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, 2024.
URL httph:t////o/oo /ttp::///ppeeeeeeeeeeem nwt http//orrmmmmiii ii=iidd22822xgg
[68] Andrea Polesel, Giovanni Ramponi, and V John Mathews. Image enhancement via adaptive unsharp masking. IEEE transactions on image processing, 9()):505-511 2000.
[69] Adam Polyak, Amit Zohar, Andrew Brown, Andros Tjandra, Animesh Sinha, Ann Lee, Apoorv Vyas, Bowen Shi, Chih-Yao Ma, Ching-Yar Yao Chuang, et al. Movie Gen: A cast of media foundation models. arXiv preprint arXiv:24100 20.0. 13720, 2024.
[70] Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. In The Eleventh International Conference on Learning Representations, 2023,
URL
wwwe//forreee wtt.://ommmmmmmmmm ?idimmiddFFFFf F
[71] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning.
pages 8748-8763. PMLR, 2021.
[72] Severi Rissanen, Markus Heinonen, and Amo Solin. Generative modelling with inverse heat dissipation. In The Eleventh International Conference on Learning Representations, 2023.
URL
wwt.wiiw...eee.e..ee..e..eeeeeee www.:/neefffmiiiiio wow.oordoiiidnPuio JUBT9F201.
[73] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[74] Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aber- man. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Proceedings of the IEEF/CV Conference on Computer Vision and Pattern Recognition, pages 22500-22510, 2023.
[75] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems, 01133677-364999 2022.
15

---

[76] Chitwan Saharia, Jonathan Ho, William Chan, Tim Salimans, David J Fleet, and Mohammad Norouzi. Image super-resolttion via iterative refinement. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(4):4713 2022.
[77] Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious Al-powered image editing. In Proceedings of the 40th International Conference on Machine Learning, 2023.
[78] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-Gare Protecting classifiers against adversarial attacks using generative models. International Conference on Learning Representations, 2018. URL https: http:::://pppptiee http//veepeeeeeeeeeeeee/ee net.eewweeeeeeeeeeeeee.eeeeeeeee net
[79] Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. Fawkes:
Protecting privacy against unauthorized deep learning models. In 29th USENIX Security Symposium, pages 1589-1604, 2020.
[80] Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. In 32nd USENIX Security Symposimm, pages 2187-2204, 2023.
[81] Yash Sharma, Gavin Weiguang Ding, and Mareus A. Brubaker. On the effectiveness of low frequency perturbations. In Proceedings of the 28th International Joint Conference on Artificial Intelligence, page 3389-3396. AAAI Press, 2019, ISBN 9780999241141.
[82] Xudong Shen, Chao Du, Tianyu Pang, Min Lin, Yongkang Wong, and Mohan Kankanhalli. Finetuning text-to-image diffusion models for faimess. In The Twelfth International Con- ference on Learning Representations, 2024. URL https: /ttp::///pee/eeeeeeeeeeee ffrmmfr bnrB5YHoYu.
[83] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. CoRR, abs/1409.1556, 2014. URL https://api. httt::::/app..ssmnniiissee www.nticscoollatt........ org
[84] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep supervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning, pages 2256-2265. PMLR, 2015.
[85] Yang Song. Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021. URL
[86] Lukas Struppek, Dom Hintersdorf, Felix Friedrich, Patrick Schramowski, Kristian Kersting, et al. Exploiting cultural biases via homoglyphs in text-to-image synthesis. Journal of Artificial Intelligence Research, 18:1017-1068, 2023.
[87] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014. URL https: //arxiv.orz org/ /atss//1....0 6199.
[88] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 1-9, 2015.
[89] Wei Ren Tan, Chee Seng Chan, Hernán E. Aguirre, and Kiyoshi Tanaka. Improved artgan for conditional synthesis of natural image and artwork. IEEE Trunsactions on Image Processing, 28(1):394-40) 409, 2019. doi: 10.110991P.221182866666
[90] Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc N Tran, and Anh Tran. Anti-DreamBooth: Protecting users from personalized text-to-image synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2116-2127, 2023.
16

---

[91] Gregory K Wallace. The JPEG still picture compression standard. Communications of the ACM, 34(4):30 44, 1991.
[92] Hanhui Wang, Yihua Zhang, Ruizheng Bai, Yue Zhao, Sijia Liu, and Zhengzhong Tu. Edit away and my face will not stay: Personal biometric defense against malicious generative editing. arXiv preprint arXiv:2411.1682, 2024.
[93] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Thirty-sevntth Conference Neural Information Processing Systems, 2023. URL https: http://oppeeeieeeeeeeeeeeeeeeeee net/forum?id=255 JrmubN1.
[94] Haotian Xue and Yongxin Chen. Pixel is a barrier: Diffuusion models are more adversarially robust than we think. arXiv preprint arXiv:2404.133220 2024.
[95] Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion- adversarial sample generation for improved stealthiness and controllability. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL id=JTwxy1P6U9.
htt////enrevee.nee..../
[96] Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffusion- mimicry through score distillation. The Twelfth International Conference on Learning Representations, 2023.
[97] Gong Zhang, Kai Wang, Xingqian Xu, Zhangyang Wang, and Humphrey Shi. Forget-me- not: Learning to forget in text-to-image diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 1755-1764, 2024.
[98] Kai Zhang, Lingbo Mo, Wenhu Chen, Huan Sun, and Yu Su. Magicbrush: A manually annotated dataset for instruction-guided image editing. In Thirty-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2023.
[99] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unrea- sonable effectiveness of deep features perceptual metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 586-595, 2018.
[100] Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. EditGuard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 11964- 11974, June 2024.
[101] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. recipe for watermarking diffusion models. arXiv preprint arXiv:2303. 10137, 200011,,2220 2023.
[102] Zhengyue Zhao, Jinhao Duan, Kaidi Xu, Chenan Wang, Rui Zhang, Zidong Du, Qi Guo, and Xing Hu. Can protective perturbation safeguard personal data from being exploited by stable diffusion? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24398-24407 2024.
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We have successfully summarized our contributions both in abstract and introduction (e.g., in the "Contribution" paragraphs).
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitation of our work in Appendix A.2.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
18

---

Justification:
This work does not contain theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We report the full experimental details in Section 5 and Appendix C.2.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
19

---

Answer: [Yes]
Justification:
We have submitted our code and data in the supplementary material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.. cc/
wwwesssssllllooooooooooooooooooo iiycy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https:
/ //iips.co.o wttpccccpppccceeeecccc.cccccccct hpppuicgguudesss..ppppppppppaaee /Codeeubeeeeeeeee gutee//eiidde/ooeeuuiiiiiiiii wswonnollllo onnolicy))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We report the full experimental details in Section 5 and Appendix C.2.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification:
We report error bars for our quantitative results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
20

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide information about the compute in Appendix C.4.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: /ttp///eerrr/.///ee
Answer: [Yes]
Justification: We have carefully reviewed the NeurIPS Code of Ethics and put our best efforts for the compliance.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- cration due to laws or regulations their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We provide a discussion of the broader impacts in Appendix A.2.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
21

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
We use publicly available models and datasets in our experiments.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We have properly cited all the original datasets and code used for our experi- ments, and provided more details about the datasets in Appendix C.3.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
22

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We provide the details about our custom dataset in Appendix C.3.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/cood/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: No user study or human participants were involved in the current submission.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
No user study or human participants were involved in the current submission.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
23

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality the research, declaration is not required.
Answer: [Yes]
Justification: We have stated in Appendix C.3 that leverage LLM in constructing custom dataset for our evaluation.
Guidelines:
The answer NA
that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: http://riss.c/oooeeeeeeeeeeeeeee cccc//o/mmeerrccce////////// for what should or should be described.
24

---

A Discussions
A.1 Additional related work
Safety concerns in generative Al Aside from the image protection technique that we focus on in this paper, generative AI has introduced various new safety concerns and there has been increasing attention to address them from a technical perspective. For instance, a line of works focuses on deepfake detection [6, 41, 47, 50, 61], iee. developing methods to detect machine- -eeeerteeeee ("fake") content within real-world data. Another possible approach is watermarking [20, 24, 54, 60, 93, 100, 101], which aims to embed a unique identifier into generated images, enabling the identification of the images or their creators. Focusing more on the modeling perspective, series of works has aimed to fine-tune models to remove specific concepts [27, 28, 32, 42, 97], e-g., nudity or certain image styles, ensuring that these concepts are excluded from generated content. Other works have focused on fairness and unbiased generation [19, 25, 82, 86]. in an attempt to mitigate biases in generative models that may generate harmful stereotypes.
Adversarial examples for good Adversarial examples [5, 12, 87] were initially introduced to demonstrate that carefully crafted noise, imperceptible to human perception, can significantly change the outputs of machine learning models, causing them to make mistakes. Recent studies, however, have explored the potential of leveraging these adversarial examples for beneficial purposes, including robustifying classification models in imbalanced learning scenarios by generating synthetic minority class samples [39], enhancing model interpretability through counterfactual explanations, which illus- trate minimal input changes needed to alter a model's prediction [36]. Notably, after the emergence of text-to-image diffusion models which can be easily misused for malicious purposes including deepfake, various studies [49, 77J have leveraged the adversarial examples against unauthorized editing facilitated by diffusion models.
A.2 Limitation and broader impact
Limitation A practical limitation of adversarial image protection is that, once an unprotected copy of an image is stolen and becomes publicly available, the perturbation safeguard the image; an adversary can simply retrieve and edit the umprotected version. Consequently, future work could investigate model-level safeguards such as authorization systems that block unveri- fied users from accessing the editing models, to prevent malicious editing at its source. Moreover, note that the protective perturbation itself should not be regarded fundamental solution for manual editing scenarios by humans. While our approach may increase the cost of Al-based editing, it does not eliminate the threat posed by manual editing. Addressing such issues ultimately requires governance-level interventions beyond technical defenses.
longer effectively
Broader impact Protecting images with adversarial perturbations offers practical benefit to Al safety by impeding unauthorized, harmful Al-based image edits. However, by demonstrating the vulnerability of existing protections, although has already been noted by Hönig et al. [34), might inadvertently encourage malicious users to abuse this vulnerability for unauthorized image editing. We therefore hope this work motivates future research that further strengthens existing protection frameworks, rather than inspiring ad verrsaris to exploit purification tools.
25

---

B Overall Procedure: BlurGuard
Algorithm 1 BlurGuard
Input: source image x; noise budget # steps T1, T2: step size V/. 723 loss coefficient
Output: protected image
I: (M, J.f f- Segment(Anythinggx)
// Segment x into R binary masks using SAM
2: Initialize ò f-
3: for each region E {1..... R. do
4: Initialize w, +-
Parameterize the logarithm of o
5: end for (Stage 1: Optimize w
6: Initialize dn (0,
// Sample Gaussian noise on for optimizing
7: for each step f. = 1y...,Ty do exp(w)
8:
9: + + 1 M, o G(ôn, σ,)
Aggregate noises with blurring to construct // Update via Adam
10: w Adammw Lice x)
11: end for
(Stage 2: Optimize 8)
12: for each step t = I,...,
, T2 do
13:
exp(w)
x+x + Dr= M, ④ g(d,
Adaptive blurring ö with the learned Update 5 via PGD within noise budget
15: t Tiadr (x) + X Tireq X x)
16:
8 clip(6 9/2 V c,
Vsl.
end for
18: & + x Σ M, @ (()
return
C Experimental Details
C.1 Evaluation metrics
To quantitatively evaluate our methods, we selected multiple metrics to assess various aspects of image quality and the effectiveness of image protection. For image quality, we selected metrics that focus on perceptual naturalness well as structural integrity and pixel-level distortions. To evaluate protection performance, we used metrics to compare perceptual, structural, and pixel-level differences between generated images from protected and unprotected source images. Additionally, selected metries to measure whether their embeddings and distributions have significantly diverged.
LPIPS Learned Perceptual Image Patch Similarity (LPIPS) [99] measures the perceptual similarity between two images by comparing features extracted from a pre-trained neural network, such as VGG [83]. It focuses on high-level perceptual differences rather than pixel-wise accuracy.
SSIM Structural Similarity Index (SSIM) evaluates structural similarity between two images, such as original image X and transformed image Y, by analyzing luminance (!), contrast (c), and structural patterns (s). It accounts for local pixel intensity patterns and combines these components into a single metrie, defined as:
SSIM(X, Y) = [X(X, Y)] [o(X, Y) [s(,, Y)).
(11)
PSNR Peak Signal-to-Noise Ratio (PSNR) assesses the similarity between images, such as an original image x and a noised image y. by calculating the ratio between the maximum possible pixel intensity and the mean squared error (MSE). provides a quantitative measure of how much the transformed image deviates from the original in terms of pixel-level fidelity, defined as:
MAX(Y)
XS Y) 20 log
(12)
MSE(X, Y)
26

---

Image Aligament (IA) Score Image Alignment (IA) is a metric that measures the similarity between the embeddings of the source image and the protected image using cosine similarity. The embeddings are extracted using Contrastive Language-Image Pretraining (CIJP) [71]. pre-trained model that effectively captures high-level features from images by mapping them into an embedding space. The cosine similarity between the embeddings e₁ and eg of two images is defined as follows:
C1 C2
IA =
(13)
||e
|
FID Fréchet Inception Distance (FID) evaluates the difference between two image sets: set of source images X and a set of images Y. It quantifies the difference in feature distributions between the two sets by extracting features with pre-trained Inception network [88] and modeling their distributions as multivariate Gaussians, characterized by means (μZ py) and covariances (Ex, Ey). The FID is calculated as:
FID = 11px- pell Tr + Ey - 2(
(14)
C.2 Implementation
Baselines For image protection baselines, we consider 4 baseline image protection methods: AdvDM [49], Mist [48], PhotoGuard [77], and SDS [96]. We set the noise budget e = 16/255 and step size y = 2/ 2/255 for each iteration of PGD attack. For PhotoGuard, we used their encoder attack with no target image as it is the simplest adversarial objective that can be easily integrated with our framework.
To ensure comprchensive evaluation, we also include additional baselines for specific tasks. For the inpainting task, we compare our framework with DiffusionGuard [18], using the same noise budget and step size in other baselines. For the textual inversion task, we include Glaze [80] an additional baseline.
Target models We use Stable Diffusion v1.4 [73] for image-to-image generation, textual inversion [26), and DreamBooth [74], while the inpainting model from Stable Diffusion v1.5 [73] is used for inpainting. For instruction-based editing, we use the pretrained InstructPix2Pix [7] model. For moage-to-image generation and inpainting, we adopt the hyperparameter settings from PhotoGuard: 100 denoising steps, guidance scale of 7.5, and r 1. For textual inversion, follow the training and sampling procedures described in Hönig et al. [34]. For instruction-bars bastd editing, we apply the default hyperparameters provided in the InstructPix2Pix checkpoint HuggingFace." For DreamBooth, we follow Anti-DreamBoot [90] for dataset sampling, training, and evaluation.
BlurGuard For constructing our protection, we optimized the logarithm of the Gaussian blur intensities log di, : log RR using the Adam optimizer with a learning rate (r)) of 0.1 during timesteps of Ti = 50. After optimizing the blur intensities, we then optimize the adversarial perturbation with our 12-normalized PGD attack during timesteps of T2 = 100 as same as other baseline protection methods. As the step size 72 for optimizing the perturbation 8, we used 7/2 20 for image-to to toaegeto--mmae generation and textual inversion task, and 7/2 = 50 for inpainting.
C.3 Datasets
ImageNet-Edit Image-to-imanee generation offers high accessibility compared to techniques such as inpainting textual inversion, which require additional masks model training. However, this accessibility also increases the risk of misuse, necessitating countermeasures. Currently, there is a lack of datasets for developing these countermeasures, hindering consistent and meaningful evaluations in concurrent research. From this perspective, we curated a benchmark dataset for image-to-image generation task which is subset of ImageNet [21] including 80 carefully selected images of animals and objects paired with editing prompts as illustrated in figure 5, We selected these images based on the following criteria: (a) images containing 40% 60% background, making it easy to edit both the background and the main object, and (b) square images close to a 512x512 resolution, as the backbone model (Stable Diffusion vl.4) is trained on this resolution. The editing prompts were generated by using ChatGPT [65] to generate captions based on the original images and then make minor modifications these captions, such as replacing certain nouns or adjectives.
27

---

standing Chesapeake Bay Retriever surrounded blooming flowers in garden.
bird perched on covered branch
in shallow wetland
filled with salad
pairs taken from ImageNet-Edit, new benchmark dataset of 80 curated samples filtered from ImageNet, combined with ChatGPT for labeling, to evaluate image protection method in image-to-image generation task.
Figure 5:
Helen For the inpainting task, we use the Helen dataset [44], following the pre-processing done by Cao et [10]. Specifically, they curated this dataset by sampling 80 images with the smallest face-to-image ratio to select images that are easy to modify. However, we found that the exact prompt set (used for editing) for this data is not publicly available; therefore we sample another set of prompts from the prompt set used by Choi et al. [18].
WikiArt We use the WikiArt dataset [89] for the textual inversion task. Each of the five artists (Albrecht Dürer, Edvard Munch, Alphonse Mucha, Edward Hopper, and Anna Ostroumova-Lebedeva was selected based on [34], with 18 images assigned to each artist.
MagicBrush For the instruction- basse editing task with InstructPix2Pix [7], we use the Mag- icBrush [98] dataset, which consists of images and corresponding instructions that can alter some aspects of the images. We randomly sampled 80 images and instructions from the test set of MagicBrush for our experiments.
VGGFace2 For the DreamBooth [74] tasks in Appendix D.1, we use the VGGFace2 [11] dataset, which is large-scale face recognition dataset. Similar to the WikiArt dataset for the textual inversion task. For evaluation, we sample 50 identities in VGGFace2, following the experimental settings of Anti-DreamBooth [90].
C.4 Compute resources
We used a single NVIDIA A100 80GB GPU to run most of the experiments conducted; including processes image protection, purification, and editing images. For fine-tuning Stable Diffusion models done for the textual inversion experiments, we used a single NVIDIA RTX 3090 GPU, and a single NVIDIA RTX 3070 8GB to run Glaze.
C.5 Purification methods
We provide overview of the seven noise purification methods considered in our experiments. These methods include not only those specifically trained for adversarial purification but also general image processing techniques that essentially work noise purifier.
JPEG compression JPEG compression [91] an image compression standard for enhancing efficiency of storing images. While this compression process utilizes Discrete Cosine Transform (DCT) quantization steps, some high-frequency details of an image can be suppressed by this compression.
Gaussian noise Adding Gaussian noise into an image itself can be a noise purification tool, but with image upscaling [62], Hönig et al. [34] claims that one can effectively purify the adversarial noise without degradation in image quality. We also consider Gaussian noise with upscaling as one of our purification tools.
28

---

Image upscaling Upscaling is process that increases the resolution of an image by interpolating additional pixels. be used noise purification because resampling smooths -eeeurryy components, making it an effective tool for mitigating adversarial noise. An effective approach is to apply upscaling after performing JPEG compression or adding Gaussian noise, as these methods help suppress or disrupt adversarial patterns before the resampling step. Following this principle, we adopt both upscaling strategies as part of our purification methods.
Impress IMPRESS [10] removes noise from protected images ensure that they can reconstruct themselves when input into diffusion model. Since protected images are visually very similar to the original images, the purified images refined retain similar visual characteristics to the protected images.
DiffPure DiffPure [63] utilizes SDEdit [58], purification method based stochastic differential equations (SDE). DiffPure employs diffusion models for adversarial purification, effectively remov- ing adversarial perturbations and recovering the original image. This process involves adding an appropriate level noise during the forward diffusion step to neutralize adversarial patterns, followed by reverse diffusion step to reconstruct a clean image.
GrIDPure GrIDPure [102] is an extension DiffPure [63]. utilizes grid-based slicing and merging process by dividing tigh-resolution images into overlapping grids, purifying each grid using the diffusion model, and then merging them back together.
PDM-Pure PDM-Pure [94] is adversarial purification method leveraging Pixel- Pixel-Space Diffusion Models (PDM). builds on SDEdit[58) by adding a small amount of noise to protected images and then performing denoising process to remove protective patterns and restore the image closer its original form.
29

---

D Additional Experiments
D.1
More editing scenarios
Naturalness
Worst-case Rffectiveness
Method
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNR
PhotoGuard (77)
0.25 0.12
0.77 0.08
28.1 0.23
177.18
0.58 0.08
0,25= 0.10
2..4
0.89 0.05
Ad-DM (o)
0.26 0.11
0.80 0.06
28.8 0.3.2.0.2 0.28
176.74
0.61 0.09
0.23 0.09
28.4 0.42
0.58 1: 0.04
Mist
0.24 0.12
0.78 0.07
+ 0.23
194.00
0.61 0.008
0.23
0.09
28.4 0.43
0.88 0.04
SDS 99]
0.22 0.10
0.80 0.06
29.0 0.37
176.89
0.57 1 0.08
0.26 0.10
25.4 1 0.30
0.59 0.05
Glaze 183)
0.14 - 0.09
0.90
0.04
31.2
+ 0.42
169.80
0.57
0.09
0.25
1226-00 0.00
28.5
0.51
0.90
0.04
Blard (Ours)
0.15 0.08
0.97 0.08
32.1
3.06
181.89
0.08
0.25
0.10
28.3 0.46
0.87 0.05
Table 8: Results on textual inversion with Stable Diffusion v1.4, under loe protection within 255 Naturalness indicates how imperceptible the protection is. Worst-case effectiveness is measured after applying 7 different noise purífication methods to the protected image, representing the robustness of each protection method. The best is highlighted in bold, while the second-best is underlined.
16
Textual inversion Textual inversion [26] enables users to associate new visual concepts or styles into unique tokens via prompt tuning. However, it risks replicating copyrighted artwork and threaten- ing intellectual property rights. We employed the WikiArt dataset [89], preprocessed as described in [34] to evaluate the performance of each protection methods. We fine-tune a text-to-image diffu- image set X representing style using training steps 2000, batch size 4, and
sion model learning rate = 5 x 10-6, following [34]. For each image x, we generate a corresponding prompt Px = Cx "by artist", where the image caption Cx is obtained using the BLIP-2 model [46]. The fine-tuned model generates images with a resolution of 768 x 768 using the DPM-Solver++ (2M) Karras scheduler [38, 53] over 50 sampling steps.
The results shows that BlurGuard surpassing most baselines in worst-case protection performance while maintaining superior image quality. Notably, BlurGuard achieves an IPIPS imperceptibility comparable to Glaze [80], which explicitly optimized for minimizing LPIPS. Considering the inherent trade-off between imperceptibility and protection effectiveness, this substantially high imperceptibility suggests the potential for higher protection effectiveness while maintaining a similar level of imperceptibility to the baselines when a larger perturbation budget is used. This strong performance stems from our per-region blurring scheme, which adaptively incorporates textural information from images with diverse patterns. Given that the artworks used in textual inversion tasks often contain rich textures and vibrant colors, as shown in Figure 15, the high imperceptibility achieved by our method in these tasks is particularly meaningful.
DreamBooth We also compared BlurGuard with other protection baselines on DreamBooth, which fine-tunes diffusion model so that the generated images depict user-specified concept. We used VGGFace2 [11] dataset to fine-tune Stable Diffusion v1.4. For the baselines, we employed Arti-DreamBooth [90] and
aati-DreamBooth [64], which specially designed frameworks to protect images against DreamBooth. Table demonstrates that BlurGuard surpasses other protection methods including High-Frequency Anti-Dreambooth which selectively applies large amount of perturbation only in high-frequency areas of the image. Moreover, the results show that BlurGuard can also be combined with other protection methods as a plug-and-play manner, supporting its high applicability.
Method
LPIPS
FID
SSIM
PSNR
IA
nnii-reamBBoth po]
0.12 + 0.02
127.93
0.51 + +011
28.5
0.47
0.88 + 0.06
High Frequency DreamBooth [+]]
0.05
138.45
0.10
0.43
0.89
0.05
BlurGuard Anti- Bett-DreaBBoth
0.12 0.10
145.75
0.49 1 0.10
28.3
0.35
0.86
0.06
Table Worst-case effectiveness of different image protection methods on Dreambooth, under foc 16 Worst-case effectiveness is measured after applying 7 different noise- purification methods. The best value bold, the second-best is underlined.
protection within e = 255
30

---

D.2 Black-box transfer
FLUN.Idde
1PPPPS
PlunoGured
0.88 0.18
0.85
0.20
0.55
Ad-DM
08.20
0.09
0.20
0.00
1.00
0.54
120.17
à
0.17=0.19
28.8....8
0.21
0.00
0.55
2..4
0.19
0.96
BlurGuard (Ours)
11221
0.46
0.08
0:46
28.43:00.5
0.88
0.05
74.34
0.26
0.00
0.79 0.00
29.0 0.00
0:933 0:0.04
Table 10: Comparison of worst-case effectiveness on ImageNet- Edit for black-box transfer. We consider two additional scenarios (a) SD-v1.4 4 - SD-v3.5 and (b) SD-v1.4 FLUX.I-dev, The best highlighted in bold, while the second-best underlined.
SD-v1.4 SinSwap
Naturalness
Worst-cuse Effectiveness
Method
LPIPS
SSIM 1
PSNR
FID
LPIPS
SSIM
PSNR
Guaro
0.01 = 0.02
0.96 0.02
38.2
2.53
18.34
0.03 0.00
0.97 0.02
10.0
2.67
0.99 + 0.00
AdvDM 1o
40.7
2.44
0.00
Mist om
0.02 0.01
0.98 +.001
00.5++2.00
14.10
0.02 0.00
0.98 0.01
41.0+ 2.43
0.99 + 0.00
SDS oM
0.06
0:03
0.96 0.02
38.9 1: 2.55
25.11
0.03 1. 0.02
0.97 0.02
38.3
2.44
2.44
0.99 0.01
DiffusionGuard (18)
0.04
0.97
30.6 2.49
0.02
0.01
40.2
2.33
0.99
BlurGaard (Ours)
0.03 = 0.02
0.99 = 0.01
38.7 2:22
31.54
0.03 0.01
0.98 0.01
38.4
2: 2.37 0.97 = 0.02
Table 11: Black black-box transfer on InpaintGurdBencch for inpainting (SD-v1.4 - SimSwap), under foo 16
protection within
The best is highlighted in bold, while the second-best is underlined.
255
Transferability across diffusion models We further examine the black-box transferability of BlurGuard by evaluating performance when adversarial protections from SD-v1.4 are transferred to newer diffusion models, including SD-v3.5 and FLUX.I-dew [43]. Note that these target models use the MMDiT architecture with flow-matching, which substantially differ from SD-v1.4. As shown in Table 10, BlurGuard consistently improves performance over PhotoGuard across all metrics, demonstrating its clear advantage enhancing transferability. Moreover, BlurGuard maintains strong and competitive protection performance across all target models, highlighting the general applicability of our framework to diverse generative architectures. These results show that BlurGuard offers broadly transferable solution for adversarial image protection in diffusion-based models.
Transferability to GAN
To examine the cross-framework transferability of BlurGuard, we conduct black-box transfer experiment from SD-v1,4 1.4 to SimSwap [14], GAN-based method for deepfake generation. We perform the evaluation on the human portrait subset InpaintGuardBench [18]. As shown in Table 11, BlurGuard maintains strong performance in both naturalness and worst- case effectiveness, confirming that the protective perturbations generated by our framework remain effective even when transferred across fundamentally different generative frameworks from diffusion models to GANs. These results highlight the robustness and broad generalizability of BlurGuard beyond diffusion-baan based architectures.
31

---

D.3
Evaluation with other diffusion models
(D-v2.1
Naturalness SSIM
Worst-case Effectiveness
Methed
LPIPS
PSNR
FID
LPIPS
SSIM
PSNR
PhatoGuard 177)
0.34 0.11
0.70 0.11
28.2 1. 0.12
145.29
0.36 0.07
0.86 2: 0.12
29.4 1: 0.85
0.91 0.04
AdvDM (eq
0.26==00 0.10
0.79 0.00
23.4+ 0.33
140.76
0.35 + 0.07
0.67 0.12
29.7 + 0.96
0.91 + 0.04
oo
28.9
143.37
0.07
28.6
0.90
SDS oo)
0.32
=
0:11
0.79
0: 0.08
29.8+
0.57
136.36
0.30 4 0.08
0.67
= 0.12
29.7
1.00
0.91 + 0.04
BlurGourd (Ours)
0.22
0.10
0.93 0.09
31.1 2.27
154.46
0.41
0.07
0.62
0.11
28.7 0.55 0.89 0.04
Table 12: Results image-to-image generation with SD-v2.1, under foo protection within 235
16
Naturalness indicates how imperceptible the protection is. Worst-case effectiveness is measured after applying 7 different noise purification methods to the protected image, representing the robustness of each protection method. The best is highlighted in bold, while the second-best is underlined.
SD-x3.5 (c-
Naturalness SSIM
Worst-case Elfectiveness
Method
LPIPS
PSNR
FID
LPIPS 1
SSIM
PSNR
IA
PooroGuard (7)
0.24 0.09
0.79 0.09
31.5+1..4
121.18
0.08
D:48= 0.19
28.6 0.64
0.88 0.05
Ad-DM (4))
0.28 = 0.10
0.77 2 0.08
29.5
116.96
0.12 1: 0.08
0/48 0.19
29.0 0.91
0.89 :: 0.05
Mist
0.25 0.08
0.80 0.09
30.9
118.91
0.45 0.08
0.48 0.19
28.6 0.64
0.88 0.05
SDS 199)
D.25 =: 0.11
0.86 2: 0.08
29.5 0.32
119.20
0.46 4 0.08
0.47 0.19
28.5 2 0.30
0.88 0.05
BlurGaard (Ours)
0.25 - 0.10
0.88 0.13
30.4 1.97 125.32
0.48 0.07
0.46
0.18
28.4 0.46
0.88 0.05
Table 13: Results on image-to-image generation with SD-v3.5, under &oo protection within 235 Naturalness indicates how imperceptible the protection is. Worst-case effectiveness is measured after applying 7 different noise purification methods to the protected image, representing the robustness of each protection method. The best highlighted in bold, while the second-best underlined.
16
F.U.XIIdev JLL
Naturalness
Effectivenesss
Mothod
LPIPS
SSIM 1
PSNR
FID:
LPIPS
SSIM L
PSNR
IA
PhotoGuurd
0.21 1: 0.10
0,56 1 0.07
32.1
0.33
80.22
0.28
0.06
0.68 1: 0.11
29.5 0.33
0.91 0.05
AdvDM 199
0.27
0.85 0.07
32.6 1.10
0.28
0.68
28.8 0.72
0.90
0.05
Mist (48)
0.26 +: 0.09
0.87
+ 0:08
32.3
84.10
0.29 0:07
0.67 2 0.12
29.7=20.00
0:90
SDS
0.21 0.10
0.68 4 0.08
32.2 0.80
81.65
0,26 0.30
0.68 4: 0.11
0.46
0.00
Guard (Ours)
0.23 + 0:11
0.07
33.4
85.21
0.30 0.10
0.67
28.4 0.33
0.89 0.05
Table 14: Results image-to-image generation with FLUX.1 -edv, under foo protection within 255 Naturalness indicates how imperceptible the protection is. Worst-case effectiveness is
measured after applying 7 different noise purification methods to the protected image, representing the robustness of each protection method. The best is highlighted in bold, while the second-best is underlined.
We further investigate the generalizability of BlurGuard across more recent diffusion models by constructing protections against Stable Diffusion v2.1 (SD-v2.1), SD-v3.5, and FLUXX.1-de) In particular, SD-v3..5 and FLUXX.1 1-dev adopt the MMDiT architecture with flow-matching training, representing substantially different design paradigm from SD-v1.4 used in most of our experiments. As summarized in Tables 12, 13, and 14, BlurGuard consistently surpasses all baseline protection methods across nearly all metrics, demonstrating its robustness and scalability to newer, more advanced diffusion backbones. Figure 6 also supports these findings qualitatively.
32

---

Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurifled)
Edited (purified)
Edited
Edit Prompt: "Foxes playing in the snow"
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurified)
Edited (purified)
Edited
Edit Prompt: "The limpkin swims in the swamp"
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurified)
Edited
Edited (purified)
Edit Prompt: "A waterbird"
Figure 6: Qualitative comparison on image-to ponggetto-mman to-image generation using Stable Diffusion v
33

---

D.4 Ablation study
Source Imagee DurrGordd
Power (ds)
25
10
-10
-20
-30
1073
Frequency
10
Figure 7: Comparison of the Radially-Averaged Power Spectral Density (RAPSD) of image protec- tions using constant Gaussian blur intensity The deviation in figh-frequency bands (right side of the plot) often corresponds to the vulnerability against noise purification.
PhotoGuard
BlurGuard
On the constant ablations We have shown that adaptive blur- ring is effective both for the naturalness and robustness of im- age protection (see Section 5.2). In Figure 7, we further show how the different blur intensities o affect the frequency spec- trum of protected images by showing their RAPSD. Unlike the original image that shows linear RAPSD trend, protected im- ages with non-blurred perturbation (a 0) or perturbation with fixed blur intensity (a 0.5, 1) show large deviations high- frequency levels. This deviation in high-frequency bands can directly harm the robustness of protection. These observations support the low protection performances shown by constant a ablations (o 0.0, 0.5, 1.0) reported Table
Figure Visualization of the added noise from PhotoGuard and BlurGuard (ours).
Visualization of perturbation We present a qualitative compari- of actual perturbations between PhotoGuard and our proposed BlurGuard in Figure 8; overall, we confirm that PhotoGuard tends generate high-frequency perturbations uniformly across the image, whereas BlurGuard applies adaptive blurring per region, producing perturbations that are both more natural and harder to purify.
Lower perturbation budget We report the results on image-to- tomge task under &oo protection within c 255 which can more practical when the perturbation is required be merely perceptible. We show that BlurGuard also demonstrates its effectiveness both in quantitative results in Table 15. While the PSNR naturalness BlurGuard may appear slightly lower, this reflects deliberate design choice rather than higher perceptibility. PSNR focuses on pixel-wise fidelity rather than perceptual similarity and often penalizes imperceptible local deviations. contrast, BlurGuard intentionally allocates perturbations within perceptually insensitive regions through region-wise frequency adaptation, which can lower PSNR while preserving imperceptibility, as qualitatively illustrated in Figure 11.
IN-Edit (e 2
Naturalness
Worst-case Effectiveness
Method
LPIPS |
SSIM
PSNR ?
FID
LPIPS
SSIM
PSNR
TA
PhotoGuard
0.06 0.04
0.89 + 0.05
32.4
0.38
57.91
0.14 0.06
0.83 003-+-0.06
31.6 1.25
0.97 0.03
AdvDM (19)
0.14 0.07
0,88
0.05
32.6 0.50
83.31
0.24
0.76
30.6 1.30
0.03
Mist
0.12 0.05
0.86
0.08
32.0
0.00+0.00 0.45
73.21
0.21 + 0.07
0.77 +.0.8
30.6
1.18
0.05 - 0.03
0.03
0.08
71.28
0.03
BlurGuard (Ours)
0.08 0.05
0.95 0.07
30.7 1
0.46
84.38
0.23 1 0.08
0.77 1 0.008
29.9 1 0.89
0.94 0.04
Table 15: Results on image-to-image generation with SD-v1.4, under too protection within 255 Naturalness indicates how imperceptible the protection is. Worst-case effectiveness is measured after applying 7 different noise purification methods to the protected image, representing the robustness of each protection method. The best highlighted in bold, while the second-best best underlined.
34

---

Lower image resolutions To reflect real-world scenarios where we often encounter variable image resolutions, we additionally evaluate BlurGuard at lower image resolutions, viz., 128x 128 and 256x For the evaluation, we down-sample the images in ImageNet- Eddttt dataset to each target resolution; the results are summarized in Table 16a and Table 16b. Interestingly, BlurGuard stands out as the only approach that could effectively preserve its effectiveness, whereas all the other considered baselines commonly suffer from significant degradation in worst-case effectiveness during the resampling procedure in handling different resolutions. These results underscore the utility of BlurGuard in a practical setup when input images differ from the 512 resolution on which the Stable Diffusion model is primarily trained.
Edit
Naturalness
Effectiveness
Method
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNK
IA
PhonoGlard (7)
0.06
0.81 0.09
29.8 + 0.37
0.07 0.84
0.92 #
11:2 1.41
0.56 0.83
AdVDM (r]
0.09 100000.00 0.05
0.85 + 0.08
29.3 0.227
82.57
0.00 + 0.04
0.91 +0001
31.50080 0.89
0.95 + 0.02
Mist (4])
0.07
= 0.10
29.7 + 0.02
118.35
0.32 0.85
0.7 0.00
=133=081
0.94 0.83
SDS (96)
0.10 0.04
0.83 + 0.08
29.6 0.055
82.06
0.06 0.04
0.91 +.003
31.9 1.39
0.96 0.02
BlurGuarrd (Ours)
0.10
0.92 08
92.5 3.54
155.88
0.23 0.08
0.84 0.05
0.66
0.90 05
(a) Results on 128 x 128 resolution.
IN-Fuli )
Naturalness
Worst-case Effectivenes
Method
LPTPS
SSIM
PSNR
FID
LPIPS 1
SSIM
PSNR L
IA
PhotoGuard (19)
0.16 0.08
0.75 1 0.10
30.0 1.600
73.80
0.13 1 0.05
0.59 1.0.1
31.8 -144
0:95 1 0.05
AdvDM (40)
0.15 0.07
0,81 A: 0.09
29.4 0.27
76.72
0.34 0.95
0.88 4: 0.04
21.4 1.38
0.96 e: 0.02
Mist (48)
0.22 0.08
0.75 1. 0.10
29.7 1 0.45
96.34
0.16 0.08
0.56 0.00
30.6 -.17
0.95 0.00
SDS (96)
0.17 0.08
0.78 A: 0.08
29.4 1: 0.47
93.78
0.34 a: 0.05
0.87 4: 0.00
31.3 1.47
0.50
a: 0.03
BlurGraard (Ours)
0.06
0.92 0.09
31.8 1 2.95
121.84
0.27 0.09
0.81 à 0.06
28.8 0.57
0.92 0.04
(b) Results on 256 256 resolution.
Table 16: Results of image-to-image generation on low-resolution inputs under for protection with 16
255 Naturalness indicates how imperceptible the protection is. Worst-case esfectiveness is
measured after applying 7 different noise purification methods to the protected image. The best is highlighted in bold, while the second-best is underlined.
Adaptive blurring parameter Table 17 shows an ablation where we vary the SAM hyperparame- ter related the number of masks that BlurGuard optimizes. Allowing more masks slightly lowers the naturalness but consistently improves worst- case effectiveness. This is likely because a higher number of masks enables more flexible optimiza- tion in BlurGuard. However, removing adaptive blurring itself significantly degrades the protec- tion, verifying its importance to BlurGuard.
IN Edit (c 255
Naturalness
Worst-case Effect..
Method
SSIM
FID: f
LPIPS
w/o Per-region masks.
0.94
96.6
0.29
Avg. # Masks 10.3.
0.91
108.5
0.34
Avg. # Masks = 21.4.
0.89
115.9
0.36
Avg Masks (Ours)
0.93
107.9
0.32
Table 17: Additional ablation results on number of masks in adaptive blurring.
J oint
Lireq
2-Staged
Figure 9: Ablation study on two-stage optimization of BlurGuard. Qualitative comparison between BlurGuard and its variant which jointly optimizes the blur intensities a and the adversarial perturba- tion& ö. We also report the trend of Tetg in each setting.
35

---

Two-stage optimization We also compare our tto-stage optimization scheme with its ablation, i... that jointly optimizes the two objectives L and Lieey As observed in Figure 9, the two-stage optimization can help to stabilize the optimization of frequency loss I-e- In qualitative manner, on the other hand, we observe that the joint optimization (left) often generates unnatural artifacts with patterns in their protection; this happens when the frequency loss Lireq is minimized by tuning ö, rather than o, making Gaussian blur less effective.
Detailed ablation on blurring design Note that BlurGuard applies adaptive blurring only to ö, not the entire image x + 6. To verify this adaptive blurring design as an effective way to control its frequency band, compare BlurGuard with two frequency adaptation variants. Specifically, apply (i) global blurring to the entire protected image x + 6, and (ii) sharpening to the perturbation ó using unsharp masking [68]. As shown in Table 18, these variants underperform BlurGuard in both naturalness and worst-case effectiveness of protection. Global blurring moderately improves robustness but shows notable drop in SSIM and LPIPS naturalness metrics compared BlurGuard, since blurring the entire image removes high-free sreh-rreeeeccy details and thus compromises perceptual quality. The adaptive sharpening scheme fails provide effective protection after purification because sharpening amplifies high-frequency components that are easily suppressed by existing purification techniques such as JPEG compression.
IN-Edit (c
Naturalness
Worst-case Effectiveness
Method
LPIPS
SSIM
PSNR
LPIPS
SSIM
PSNR
IA
PhotoGaurd mm
0.34 1 0.11
0.70 1 0.11
28.2
0.32
92.21
0.27 1 0.07
0.73 0.30
29.9 1.07
0.94 1: 0.04
Blur(6)
0.21 1 0.10
0.93 1 0.09
31.1 2.29
107.88
0.32
0.09
0.70
1.001...00 0.09
28.8
0.42
0.92 0.05
Blur(x
0.32 1: 0.11
0.79 0.08
32.3 1.11
98.45
0.30 = 0.07
0.71 0.30
30.1
00.1:110 1.21
0.94 = 0.04
Sharpea(
0.35 :: 0.12
0.10
30.9
82.72
0,28 = 0.08
0.72
30.1 1,38
0.91
Table 18: Comparison of BlurGuard with additional blurring design ablations.
36

---

E Additional Qualitative Results
In this section, we report additional qualitative results of our proposed method, BlurGuard, further support its effectiveness. In Figure 10, we report additional qualitative results on the black-box transfer experiments (Section 5.1). Figure 12, Figure 14, and Figure 15 compares BlurGuard with other baselines in image-to-imase generation, inpainting, and textual inversion tasks, respectively. Figure supplies qualitative results on the Stable Diffusion v2.1 model (Appendix D.3).
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurified)
Edited (purified)
Edited
Edit Prompt: "Chesapeake Bay Retriever surrounded by blooming flowers garden"
(a)
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurified)
(purified)
Edited
Edited
Edit Prompt: "An owl on a snowy day"
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
(Unpurifie)
Edited
(purified)
Edited
Edited
Edit Prompt: "A wooden ship by the pool"
Figure 10: Qualitative comparison on black-box transfer, where each protection is crafted using SD-v1.4 and tested on SD-v2.1.
37

---

Source
PhotoGuard
SDS
MIST
AdVDM
BlurGuard
Protection
Edited (Unpunfled)
Edited
Edited (Purifled)
Edit prompt: "Foxes playing in the snow"
(a)
Source
PhotoGuard
SDS
MIST
AdvDM
BlurGuard
Protection
Edited (Unpurfiee)
Edited
Edited (Purifled)
Edit prompt:
"A dog is wearing clothes"
(b)
Source
PhotoGuard
SDS
MIST
AdvDM
BlurGuard
Protection
Edited (Unpuriffed)
Edited
Edited (Purffled)
Edit prompt:
"A white stork standing in shallow w
Figure 11: Qualitative results on image-to-image generation under fxx protection within e While all baselines fail to protect the image after purification, only BlurGuard remains robust after purification, generating unrealistic images.
8
255
38

---

Source
PhotoGuard
MIST
AdvDM
BlurGuard
Protection
Edited (Unpurifie)
Edited
Edited (Puriflec]
Edit prompt:
"A limpkin is
swinming the swamp"
Source
PhotoGuard
SDS
MIST
AdvDM
BlurGuard
Protection
Edited (Unpurifted)
Edited
Edited (Purified)
Edit prompt: dog walks through thick mud in foggy field."
(b)
Figure 12: Qualitative results on image-to to-image generation under foc protection within
255
While all baselines fail to protect the image after purification, only BlurGuard remains robust after purification, generating unrealistic images.
Source
PhotoGuard
SDS
Mist
AdvDM
BlurGuard
Edited (Unpurified)
Edited (Purified)
Edited
Edit Prompt: "Foxes playing in the snow"
Figure 13: Qualitative comparison of black-box transfer under foe protection within
255 where
166
each protection is crafted using SD-v1.4 while tested SD-v2.1.
39

---

Source
DiffusionGuard
GuatoGuard
SDS
MIST
AdvOM
BlurGuard
Protection
Editad (Unpunifed)
Edited
Edit prompt:
Edited (Purfledd
"A woman in hospital"
(a)
DiffusionGuard
PhotoGuard
AdVDM
BlurGuard
Protection
Edited (Unpurified)
Edited
Edit prompt: man riding notorcycle"
Edited (Purffied
DiffusionGuard
PhotoGuard
AdVDM
BlurG
Protection
A
Editdd (Unpurffed)
Edited
Edit prompt:
Edited [Purifeed]
"A woman driving car"
Baselines are eventually purified and produce realistic edits, whereas BlurGuard disrupts inpainting.
Figure 14: Qualitative inpainting results within = 255
40

---

'Edwwrrd Happer
Glaze
PhotoGuard uard
SDS
Mist
AdVDM
BlurGuard
Protection
Mimary (Umpurtted)
Mirricy
Mimicry (Purifldd)
Prompt "A golden apple
by [V]"
"Edvard Munch"
Glaze
PhotoGuard
BlurGuard
Protection
Mimiory (Unpurtted)
Mirricry
Mimicry (Purifodd)
Prompt
"A shoe by [V]"
(b)
"Edvard Munch"
Glaze
PholoGuard
SDS
Mist
AdvDM
BlurGuard
Protection
Mimicry (Unpurtted)
Mimiicy
Mimiccy (Puriffed)
Prompt golden apple by [v]"
(c)
Figure 15: Qualitative results on textual inversion within
BlurGuard introduces artifacts that
255
block style extraction; baselines allow near-ide cear-identical styles.
41

---

F
Individual Effects of Tested Purifications
PhotoGuard
JPEG
PPEG -Up
Noise
DMIP
GriDPure
PDM
Impress
Purifed
Editod (Purifled)
Edited
Edit prompt "A dog sitting on blue couch"
Figure 16: Qualitative examples of various purified images and the corresponding generated images
after applying PhotoGuard protection. The notation "Up" indicates upscaling.
Following our definition of worst-case effectiveness, test seven different purification methods (viz., as shown in Figure 16) per sample and select the result that deviated the least from the original edited image. Here, we present the detailed results of each noise purification method. Specifically, we evaluate across all eight cases: when each of the seven purification methods is applied individually and when no purification is applied. Table 19 presents the detailed results for the image-to-image generation task, Table 20 corresponds to the inpainting task, and Table 21 reports the results for the textual inversion task.
Although all baseline protections are readily bypassed by the purification tools we evaluate, BlurGuard remains robust against each one of them. Furthermore, we observed that the protection effectiveness of BlurGuard occasionally increases after purification, as reported in Table 19, Table20, and Table 21. existing purification
This counterintuitive observation emphasizes the resilience of BlurGuard techniques. Since BlurGuard relies minimally on high-frequency components as shown in Figure 2a and Figure 8, purification methods that aggressively suppress high frequencies can cause the purified image to deviate further from the source image as illustrated in Figure 2b.
Before Portfication
Noise Upscaling
Method
FID
LPPIS
SSIM
PSNR
IA
FID
LPIIS
SSIM
PSNR
IA
PhotoGuard
201.56 56
0.68
0.10
0.38 1 0.09
28.1 0.26
0.79
0.08
103.65
0.35 1.1.1
0.65 0.10
29.2 0.70
0.90 0.07
AdVDM
256.55
0.12
0.30
28.6=0.1
0.08
109.07
0..00
0.08
0.40
+.006
Mist
233.71
0.00 0.08
0.42
0.07
0.75
101.25
29.0
0.82
0:07
SDS
180.00
0.67
0.12
0.40
0.30
28:2-0.3
0.79 3
0.08
07.42
0:33
0.10
29.4
0.87
0.90++000 0.006
Blur (Ours)
116.21
1: 0:11
0.65
28.5
0.30 1: 0.06
110.68
0:40
0:100
0.10
284 0.25
0.88:1
0.06
JPEG
JPEG Upscaling
Method
FID
LPIPS
SSIM
PSNR
IA
FID
LPIPS
SSIM
PSNR
LA |
PhotoGuard mo
141.38 18
0.51 1 0.11
0.50 1 0.07
28.7 0:37
0.85 1 0.08
105.08
0.36
0.
0.64 1 0.00
29.
0.51
0.88 1.0.8
Ad-DM DM
217 45
0.50
1: 0.15
0:45
1: 0.05
28.7 0:39
0.83 1:
0.07
130.22
0.36
1.0.1.1.11
0.64 5 0.00
29.
0.51
0.88 0.01
Mist
0.30 0.10
0.50
0.08
124.02
0,00
0.42
SUSS
0.11
0.54
Guard (Ours)
0.36
0.07 1
116.09
28.4 0.26
DillPure
GrIDPire
Method
FID
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNK
IA
PhotoGaard (7))
1/2.21
0.35 +: 0.09
0,00
= 0.12
29.7
1.10
0.52 + 0.05
128
0.34
2 10
0.68 0.12
28.8 #: 1.69
0.88 4
Ad-DM DM us
06.27
0.37 + 0.11
0.60
+ 0.11
20.9
1.02
0.91
+ 0.06
125.62
0.40
+.0.1
0.68 = 0.08
28.8 0.74
0.80 +.0.6
Mist
00.96
0.57
+ 0.10
0.68
+ 0.11
20.6
0.85
0.91
+ 0.05
140.20
0:39
+-0.00
0.64 0.10
28.6+ 0.71
0.86+-0.00
SDS
96.85
0.31 1.11.00 0.00
0.70
0.11
30.1
1.24
0.92
0.05
114.60
0.32
1.009
0.69 0.11
28.7
0.77
0.89 0.00
Blur (Oues)
0.65
0.06
133.24
28.5 0.50
+0006
Impress
PDM-PPee
SSIM
PSNR
PhotoGGaard 1m
173.01
+ 0.10
0.41 0.08
28.2 0:20
0.81
0.08
124.20
0:36 0.10
0.12
29.6 1,10
0.80-t 0.066
Ad+DM sej
197.55 58
0.06
0.10
0.19
1 0.06
28.4 0.410.00 0.47
0.81
1 0.08
109.36
0.36
0.1.1
0.70 1 0.11
30.0 1: 1.16
0.89 0.06
Mist 1eQ
200 25
0.53
+ 0.08
0.22
+ 0.00
28.1 0.21
0.77
+ 0.09
121.58
0.38
001.1
0.68
0.12
29.4 0.81
0.88
0.00
SES
156.37
0.39 4: 0.11
0.44
=: 0.08
28.5 0:35
0.83
0.07
107.19
0.35 0.00
0U89
0.11
30.1
1.20
0.50
0:00
Blur Guard (Oues)
114.12
0.40 0.11
0.00 + 0.10
28.5 0:27
0.88 + 0.07
149.43
0.47 0:1.1
0.64 0.12
28.4 0.29
0.85 0.07
Table 19: Detailed results on image-to-image generation under foo protection within e = 255 Before purification represents the protection of the editing result without any purification, while the others show the protection after applying seven different noise purification techniques before editing.
16
42

---

Purtfication
Upscaling
Metbod
FID
LPTPS
SSIM
PSNR
F1D
LPIPS
SSIM 1
PSNR
IA
PhotoCrard mm
171.00 022
0.51 + 0.08
0.46
+ 0.0.2
28.4 0.22
0.82 + 0.005
142.39
0.48 +-0.11
0.57 + 0.12
28.6
0.47
0.87 +.0.6
AdDDM DM je
140.15
0.42
1 0.12
0.61
1 0.14
29.6
0.58
0.55 1 0.00
127.54
0.39 1.0.11
0.63
005.1.00
0.11
29.2 1 0.61
0.89 0.000
Mist
131. 42
0.44 + 0.10
0.58
+ 0.30
29.2
0.88 4 0.00
124.66
0.300
#:101
0.64
0 0.12
29.2 0.57
0.89 1:000:0000
SLDS
0.13
0.00
0.69
0.07
137.87
0.50 0.300
0.56
0.11
28.8
0.42
4:07
DiffasionEuard
0.09
0.50
28.8 0.33
132.70
BlurGward (Ours)
102.92
0.30 0.10
0.50
0.08
173.90
0.57
0.12
28.4 0.25
JPBG
JPEG Upscaling
Method
FID
LPPPS
SSIM
PSNR
F1D
LPIPS
PSNR
TA
PhotoG (m))
142.30
0.32 + 0.10
0.53 = 0.11
28.9
0.32
0.85 # 0.08
131.93
0.40 0:1.1
0.62 = 0.12
29.2 #: 0.48
0.87 #
DM UM
110. 48
0.37 + 0.14
0.64
+
20.7
0.63
0.50
+ 0.08
105.26
0.20 +-0.0--.11
0.72 + 0.13
30.0
0.80
0.94 +-0.5
Mist (R]
118.65
0.38
1: 0.11
0.64
1
29.5 0.53
0.90 1:001:00 0.07
109.37
0.31 0.0.9
0.71
1 0.08
29.8
L 0.57
0.92 1.0.0
SDS
146.17
0.47 1 0.14
0.57
1 0.18
29.2 0.64
0.85 1 0.08
108.05
0.47 1.1.4
0.54 0.18
29.1 0.55
0.85 0.08
DifrassooGiard (1g
0.02
=9.1=
0.09
123.32
0.14
0.00
Blard (Ours)
0.11
0.06
0.08
166.08
0.62
0.56 0.14
0.25
0,80
DillPure
GrlDPure
Method
FID
LPPPS
SSIM
PSNR
FID
LPIPS
|
PSNR
IA
PhotoGrardd (T))
135..01
0:4++
0.12
0.67
+.01
20.0
0.55
0.07
146.84
0.60
0.16
28.5
0.32
0.80
AdrDM (e)
134.25
0.42 0.11
0.60
+ 0.15
2042-0.77
0.85 + 0.08
144.25
0.42
0.1.2
0.62
0.16
28.5+ 0.31
0.87 + 0.00
Mist 180
129 47
0:41
1: 0.10
0.66
1: 0.15
20.1 0:43
0.90 1: 0.06
142.26
0.40
1:0 0.10
0.63
5 0.12
28.5
0.51
0.88 1: 0.0
STXS
1333.75 78
0.43+
0.11
0.58
+.0.4
20.1
111+00.41 0.41
0.88
+ 0.07
158.96
0.46 +-1.1
0.57
0.17
28.4
+ 0.30
0.85+ +
DiffasiooGGand
131.00 00
0.43
0.11
0.58
29.1
0:42
0.88
0.08
147.91
0.42
0.1.2
0.61
0.15
28.5
1 0.51
0.87 0.07
BlurGuard (Ours)
106.29
0.55 0.11
0.52
0.16
28.5 0.28
1: 0.08
173.50
0.53 0.112
0.17
28.6 0.35
0.81 0.08
Impress
PDM-Pure
Method
SSIM
PSNR
1
PSNR
LA.
PhoroGrard (7))
154.18
0.08
0.47
0.30
28.6
0.07
153.37
0:46
29.2
0.46
AdrDM se
140.84
0.44
4: 0.11
0.50
4: 0.12
29.2
0:40
0.88 4: 0.07
149.97
0.45 0.1.0
0.60 0.13
29.3 0.50
0.86
0.00
Mist 180
1:31 40
0.44
+ 0.10
0.58
+ 0.00
29.1 0.35
0.88 + 0.06
145.65
0.44 +00.1
0.61 = 0.13
29.3
0.52
0.86+ +00.6
SDS pM
154.33
0.48
1 0.12
0.57
1 0.14
29.0 0.50
0.85
1 0.07
156.90
0.45 1.1.1
0.60
1 0.13
29.3
1 0.51
0.85 0.00
DiffasionGuand me
161 81
0.57
0.00
0.51
+ 0.10
28.8
0.30
0.84
0.07
140.40
0.46
1.1.1
0.50
0.15
29.3 4: 0.56
0.86 0.0.8
BlurGuard (Ours)
168. K3
0.51
1 0.00
0.56
0.300
28.4 0:25
0.80 1 0.00
180.71
0.57 1.012
0.53
0.16
28.4 0.26
0.79 1.700
Table 20: Detailed results on inpainting under &o protection within represents the protection of the editing result without any purification, while the others show the protection after applying seven different noise purification techniques before editing.
255 Before purification
16
Belore Purification
Noise Upscaling
Mothod
FID
LPIPS
SSIM
PSNR
LA
FID
LPIPS
SSIM 1
PSNR
LA L
PhotoGuard (T)
195.57
0.72 4: 0.12
0,20 1: 0.09
28.1
0.30
0.81 1: 0.08
179.01
0.62
0.00
0.22 0,08
28.2
0.27
0.85 1: 0.07
Ach DM
203.50
0.68
0.09
0.16
1 0.07
28.2
0.39
0.81 1 0.08
176.74
0.65 1.009
0.17 1 0.07
28.2
1 0.26
0.85 1.0.6
Mist
0.70 0.08
0.12
0.06
28:2
0.08
194.00
0.00
0.18 0.07
28.2
1:27
0.84
SDS
200.32
0.09
0.20
28.1
0.07
176.89
0.008
0.08
0.29
Guard (Ques)
8: 0.10
0.22
0.30
2812
0.08
181,89
0.63
28. 0.22
JPBG
JPBG Upeculing
Method
FID
LPTPS
SSIM
PSNR
IA
FID
LPIPS
SSIM
PSNR
IA L
PhotoGrard (7))
180.28
0.64 + 0.11
0.18 + 0.07
28.2
0.35
0 + 0.06
177.18
0.61
+.0.0
0.23 = 0.08
28.2+ 0.34
0.86 +.007
Adh DM uM
188.50 54
0.67 1 0.00
0.17 0.06
28.2
0.36
0.53 1 0.08
188.58
0.66
0.0.0
0.15 1. 0.07
28.2
0.32
0.84 1.000
Mist
1960.2
0.06
2: 0.00
0.14
à: 0.07
28.2
0.33
0.82
4: 0.08
204.39
0.65 0.00
0.15 =: 0.06
28.2
0.31
0.81
2 0.00
SDS
182.
0.53
0.09
0.20
0.08
28.2
0.85
0.06
181.00
0.09
0.10
28.2 0.30
0.80 0.06
BlurGward (Ours)
199:35
0.09
0.22 0,09
0.07
208.87
0.63
0.10
0.25
0.83 0.07
DillPure
GelDPure
Method
SSIM
PSNR
LPIPS
PSNK
LA.
PhotoGrard (7))
200-44
+ 0.08
0.22
0.10
28.2
0.33
0.06
196.18
0.63 0.100
0.23 0.10
28.2 0.37
AdrDM se]
194.33
0.70
à: 0.09
0.20
4: 0.09
28.1
0.25
0.82 #: 0.07
204.69
0.64 0.07
0.17
0.07
28.2 0.31
0.83 0.07
Misl 190
201 03
0/68
+ 0.07
0.26
+ 0.08
28.1
0.23
0.96 + 0.05
204.00
0.66 +00.0
0.17 + 0.08
28.2 0.28
0.82 +0007
SDS pM)
190.13
0.96
1 0.07
0.22
1 0.10
28.2
0.28
0.51 1 0.06
101.57
0.63
0.09
0.22 1 0.00
28.2 1 0.34
0.63 0.00
Guard (Oues)
202.08
0.71 + 0.07
0.21 + 0.00
28.0 0:16
0.81 + 0.08
204.27
0.65 +.0.0
0.22 0.08
28 + 0.25
0.81 +-000
Impress
PDM-Pure
Metbod
FID
LPIPS
SSIM
PSNR
FID
LPIPS
SSIM
PSNR
LA.
PhotoGuard po
0.10
0.19
0.07
200:25
28.2
Ad se
200.67
0.67
0.00
0.17
28.2
0.08
198.20
0.05
0.20 0.09
28.3 0.39
Mist soa
256 66
0.69
0.08
0.11 0.05
28.2 0.36
0.78
0.08
235.53
0.66
1.1.1
0.20 0.08
28.2 0.00
0.83 1.006
SES pqg
181.76
0.56
0.07
0.20
+ 0.07
28.1
0.24
0.84
+ 0.07
189.37
0.65
+ 0.00
0.23
0.10
28.2
0.36
0.84
+ 0:00
BlurGuard (Oues)
202.42
0.64 + 0.10
0.20
+ 0.08
28.2 0.48
0.81
+ 0.08
221.77
0.69 0.000
0.21 = 0.08
28.1
+ 0.25
0.81 0:00
Table 21: Detailed results on textual inversion under foo protection within e = represents the protection of the editing result without any purification, while the others show the protection after applying seven different noise purification techniques before editing.
255 Before purification
16
43


Reviews:
[{"review_id": "1bE2WdbseK", "reviewer": "Reviewer_fDxR", "summary": "BlurGuard is a effective image protection method designed to improve robustness against AI-driven image editing. It addresses the vulnerability that prior adversarial noise-based protections can be easily reversed by simple post-processing. BlurGuard’s approach is to apply an adaptive local Gaussian blur to the embedded perturbation to adjust its frequency spectrum, making the protective noise difficult to extract while mitigating image quality loss. Experiments show that this method significantly improves worst-case protection performance under diverse image editing scenarios and noise-removal attacks, and achieves superior image quality compared to existing methods.", "questions": "1. Lack of Comparison with the Most Recent Methods. The comparative methods used in the experimental section are primarily from 2023 and do not include the most up-to-date techniques. For example, more recent approaches such as Distraction is All You Need and EditShield could be incorporated to provide a more comprehensive evaluation.\n2. Insufficient Explanation in Certain Experimental Results. Some parts of the experimental analysis lack detailed interpretation. For instance, in Table 9, the BlurGuard method exhibits relatively lower performance in terms of PSNR under the \"Naturalness\" metric, yet no corresponding explanation is provided in the text.\n3. Lack of Discussion on Alternative Tampering Methods. BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.\n4. Omission of Acronym Explanations. Certain acronyms are not clearly defined in the main text. For example, the “I.A.” metric in Table 1 is not explicitly explained in the body of the paper. Although it is addressed in the appendix, its meaning should be clarified in the main text or table caption to avoid confusion, especially for first-time readers.", "limitations": "Lack of Discussion on Alternative Tampering Methods. BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths：\n1. Innovativeness of the Work.This study demonstrates a notable degree of innovation. The proposed BlurGuard method adjusts the frequency bandwidth of adversarial noise via adaptive Gaussian blurring, presenting a simple yet effective strategy to enhance the robustness of adversarial image protection. Compared to existing approaches, this method emphasizes alignment with the natural frequency spectrum of images, thereby improving the perceptual naturalness of the protected outputs.\n2. Comprehensiveness of the Experimental Evaluation. The experimental section of the paper is well-developed and comprehensive. It provides strong empirical evidence supporting the effectiveness and robustness of BlurGuard. The experiments are rigorously designed and the results are presented in detail, highlighting the advantages of the method under various attack scenarios.\n3. Construction of a Dataset. The study acknowledges the lack of publicly available standardized datasets for malicious image editing and accordingly constructs a tailored evaluation dataset. This dataset encompasses a diverse set of images and editing intentions, facilitating consistent and meaningful comparisons across different protection methods.\n4. Clarity and Logical Organization of the Paper. The paper is clearly written and logically organized. The arguments are well-structured and coherent, enabling readers to follow the motivation, methodology, and contributions of the work in a systematic and persuasive manner.\nWeakness：\n1. Lack of Comparison with the Recent Methods.The comparative methods used in the experimental section are primarily from 2023 and do not include the most up-to-date techniques. For example, more recent approaches such as Distraction is All You Need and EditShield could be incorporated to provide a more comprehensive evaluation.\n2. Insufficient Explanation in Certain Experimental Results.Some parts of the experimental analysis lack detailed interpretation. For instance, in Table 9, the BlurGuard method exhibits relatively lower performance in terms of PSNR under the \"Naturalness\" metric, yet no corresponding explanation is provided in the text.\n3. Lack of Discussion on Alternative Tampering Methods.BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.\n4. Omission of Acronym Explanations.Certain acronyms are not clearly defined in the main text. For example, the “I.A.” metric in Table 1 is not explicitly explained in the body of the paper. Although it is addressed in the appendix, its meaning should be clarified in the main text or table caption to avoid confusion, especially for first-time readers.", "was_revised": true, "final_justification": "The authors have addressed most of our concerns in the rebuttal process.", "rebuttal": "We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.\n\n---\n\n**Q1. Additional baselines**\n\nThank you for suggesting additional baselines. In our experiments, we selected our baselines that are most commonly considered in recent literature on adversarial image protection. We note that we also made an effort to include more recent techniques where possible, e.g., DiffusionGuard (2025) [1] and High-Frequency Anti-DreamBooth (2024) [2], as well as state-of-the-art purification-based defenses like GrID‑Pure (2024) [3] and PDM‑Pure (2024) [4]. In response to your suggestion, we have additionally compared BlurGuard with EditShield [5] you mentioned, although we were unfortunately unable to include “Distraction is All You Need” [6] due to the lack of publicly available code. As summarized in the table below, the results further confirm the strong robustness of BlurGuard as a natural and effective image protection method. We will incorporate these and more results in the final draft. \n\n| MagicBrush | │ | **Naturalness** |  |  | │ | **Worst** | **case effect** |  |  |  |\n|---|---|---|---|---|---|---|---|---|---|---|\n| **($\\varepsilon=16/255$)** | │ | **LPIPS↓** | **SSIM↑** | **PSNR↑** | │ | **FID↑** | **LPIPS↑** | **SSIM↓** | **PSNR↓** | **I.A.↓** |\n| PhotoGuard | │ | **0.19±0.10** | 0.74±0.09 | **31.1±0.22** | │ | 96.23 | 0.21±0.09 | 0.73±0.11 | 30.7±1.50 | 0.96±0.03 |\n| AdvDM      | │ | 0.27±0.08     | $\\underline{0.76\\pm 0.07}$ | 28.9±0.24     | │ | 123.39 | 0.30±0.09 | 0.67±0.13 | 30.2±1.25 | $\\underline{0.93\\pm 0.04}$ |\n| Mist       | │ | 0.26±0.09     | 0.74±0.08 | 28.6±0.17     | │ | $\\underline{123.54}$ | 0.30±0.09 | 0.66±0.12 | $\\underline{29.8\\pm 0.94}$ | $\\underline{0.93\\pm 0.04}$ |\n| SDS        | │ | 0.23±0.07     | 0.74±0.07 | 29.1±0.37     | │ | 115.23 | 0.27±0.09 | 0.68±0.13 | 30.3±1.38 | 0.94±0.04 |\n| $\\textcolor{blue}{\\text{EditShield}}$ | │ | 0.36±0.13 | 0.75±0.09 | $\\underline{31.0\\pm 0.23}$ | │ | 120.13 | $\\underline{0.33\\pm 0.09}$ | $\\underline{0.65\\pm 0.13}$ | 29.9±1.26 | $\\underline{0.93\\pm 0.04}$ |\n| **BlurGuard** | │ | $\\underline{0.20\\pm 0.08}$ | **0.89±0.07** | 30.1±1.76 | │ | **138.22** | **0.36±0.10** | **0.64±0.12** | **28.8±0.55** | **0.90±0.06** |\n\n\n\n\n\n\n---\n\n**Q2. Table 9: Clarification on PSNR results**\n\nWe remark that PSNR primarily captures pixel-wise differences to measure naturalness, and accounts less for perceptual relevance; often penalizing even imperceptible changes. BlurGuard intentionally applies stronger perturbations in perceptually insensitive regions to improve robustness while maintaining visual quality. These imperceptible changes can slightly lower PSNR, despite not affecting human perception. This aspect is better reflected in stronger performance on perceptual metrics like SSIM and LPIPS, and is further supported by qualitative results in Figure 11 in Appendix. We will clarify this point in the final version.\n\n---\n\n**Q3. Discussion on non-diffusion editing methods**\n\nWe acknowledge that the transferability of adversarial image protection methods, e.g., to non-diffusion editing methods, is an important step toward increasing their practical applicability. In particular, the question of whether adversarial perturbations crafted for one type of editor (e.g., a diffusion model) can effectively transfer to other types of (black-box) editing tools, e.g., GAN-based models, remains a technically challenging and, to our knowledge, under-explored problem. In this work, we focus on diffusion-based pipelines, as they currently represent the most widely used class of image editing models in both academic and commercial settings. We think extending BlurGuard to cover non-diffusion editors is a promising future direction, and we will reflect this point in the final draft by revising the discussion of limitations (e.g., in Appendix A.2).\n\n---\n\n**Q4. “I.A.”: Should be defined in the main text**\n\nThank you for the incisive comment. We will ensure that the I.A. metric is clearly defined and explained in the main text of the final draft.\n\n---\n[1] Choi et al., DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR 2025. \\\n[2] Onikubo et al., High-Frequency Anti-DreamBooth: Robust Defense against Personalized Image Synthesis. ECCV Workshop 2024. \\\n[3] Zhao et al., Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? CVPR 2024. \\\n[4] Xue et al., Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think. 2024. \\\n[5] Chen et al., EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models. ECCV 2024. \\\n[6] Lo et al., Distraction is all you need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing. CVPR 2024. \n\n---"}, {"review_id": "w3gdrJf6II", "reviewer": "Reviewer_Y1wo", "summary": "This paper asserts that existing data poisons for diffusion models are weak to purification-based defenses because they fail to conform to the data prior expected by the diffusion models. They propose that this nonconformity can be identified as a deviation from real (unpoisoned) images in the frequency spectrum, as measured by RAPSD curves. They propose an adaptive per-region blurring operation applied to adversarial noise in order to encourage the adversarial images to align closer to real images. They present experiments, comparing BlurGuard to multiple current poisons and validating their method across multiple defenses. They measure the naturalness (i.e., imperceptibility) and effectiveness (i.e., worst-case performance decrease after purification) of adversarial images.", "questions": "I have given multiple suggestions in Strengths and Weaknesses. In particular, I emphasize additional ablation studies and improved clarity in section 4. I think these improvements are necessary to accept the paper.", "limitations": "Yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 1, "significance": 4, "originality": 2, "strengths_and_weaknesses": "- Significance: Protection for personal data or copyright against copying or theft is an important topic. Moreover, existing protections for images are easily circumvented by purification-based (or other) defenses. Research into effective data poisons is necessary if artists and copyright holders are to continue publishing their work in a public setting.\n- Originality: BlurGuard has moderate originality. Most poisons in diffusion literature utilize an adversarial component and a perceptibility constraint (e.g., LPIPS in Glaze/Nightshade or a simple norm-ball on adversarial signal). Prior works on poisoning in other domains have explored blurring and sharpening filters as poisons (e.g., https://arxiv.org/abs/2303.04278, https://link.springer.com/chapter/10.1007/978-3-031-73464-9_5). In the diffusion domain, Gaussian blur has been used to model transitions between probability distributions (i.e., heat dissipation vs diffusion) (e.g., https://arxiv.org/pdf/2206.13397). Papers in that area have also utilized spectral density plots for analysis. Regardless, I have not seen these specific components combined for the purpose of poisoning. I think that more exploration into poisons that focus on the frequency-spectrum analysis is necessary, and so BlurGuard is a step in the right direction. The existing ablations in the paper and Appendix G are insightful and valuable. It would be even better if the paper could conduct further ablations to serve as a foundation for further research. Some that come to mind include testing other adversarial objectives instead of just EncoderAttack, analyzing sharpening in addition to blur, and applying blur to the adversarial image (x + delta) instead of just the adversarial noise.\n- Clarity: Clarity is a particular weakness of this paper. My main complaint is the organization of sections 3 and 4. Equation 1 has a notational error, as the argmin of L_enc is equal to the MSE objective, but its argmin is not. Equation 4 is introduced and then never used. I think \"Per-Region Adaptation\" should be introduced before \"Learnable Gaussian Blurring\" in section 4.2 since masking and blurring are strongly linked in BlurGuard. Notation for distance constraints seems inconsistent, using d(-,-), ball B, or ||-||. Also it seems epsilon and eta are used interchangeably. Perhaps a simplified (shorter) Algorithm 1 should be shown in the main paper because the multi-stage optimization procedure is unintuitive, especially with using dummy deltas during stage 1. Elsewhere, some figures have near-unreadable labels (e.g., Fig. 2, Fig. 4). Fig. 4 and its discussion are confusing: I don't understand what is meant by the \"Worst-Case Gap\", does the low value of BlurGuard's \"Worst-case Gap\" indicate that it performs strongly even with a 1/255 adversarial perturbation? \n- Quality: The paper is generally well-written, with straightforward introduction and experiments sections, as well as a nicely organized Appendix. I cite the extensive studies in the appendix as a strength. The authors have also benchmarked performance against a large set of modern adversarial methods and purification methods.", "was_revised": true, "final_justification": "The authors have answered my questions and addressed my concerns.", "rebuttal": "We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.\n\n---\n\n**Q1. BlurGuard with other adversarial objectives**\n\n\nAs you mentioned, BlurGuard is compatible with a variety of adversarial image protection objectives beyond the encoder attack primarily considered in our experiments. Following your suggestion, we have additionally tested BlurGuard in combination with other adversarial objectives, viz., AdvDM [1] and Mist [2]. Specifically, AdvDM aims to directly maximize the denoising loss of the diffusion process, and Mist considers a combined form of encoder and denoising attacks. As shown in the table below, we observe that BlurGuard preserves its effectiveness in improving both naturalness and worst-case effectiveness of both attacks, confirming the broad applicability of our framework across diverse protection objectives. We will incorporate these additional results in the final draft.\n\n|ImageNet-Edit| │ |**Naturalness**|||│|**Worst**|**case effect**||||\n|---|---|---|---|---|---|---|---|---|---|---|\n| **($\\varepsilon=16/255$)** | │|**LPIPS↓**|**SSIM↑**|**PSNR↑**|│|**FID↑**|**LPIPS↑**|**SSIM↓**|**PSNR↓**|**I.A.↓**|\n|AdvDM| │|0.36±0.12|0.74±0.09|28.9±0.28|│|98.27|0.30±0.08|0.73±0.09|30.2±1.17|**0.93±0.04**|\n|**AdvDM + BlurGuard**| │|**0.25±0.07**|**0.81±0.09**|**30.1±2.19**|│|**101.84**|**0.35±0.09**|**0.70±0.09**|**28.2±2.03**|**0.93±0.05**|\n|Mist| │|0.35±0.12|0.72±0.10|28.6±0.25|│|90.96|0.30±0.07|0.71±0.09|29.7±0.86|0.93±0.04|\n|**Mist + BlurGuard**| │|**0.33±0.11**|**0.86±0.08**|**32.3±2.21**|│|**137.91**|**0.42±0.10**|**0.63±0.07**|**28.8±0.47**|**0.89±0.06**|\n\n---\n\n**Q2. Additional ablation study**\n\nWe appreciate your insightful suggestions regarding further ablation studies. In response, we have conducted additional experiments based on the following two ablations of BlurGuard: (a) applying blurring directly to the protected image (i.e., $\\mathbf{x} + \\boldsymbol{\\delta}$) rather than only to the perturbation (i.e., $\\boldsymbol{\\delta}$), and (b) replacing the blurring operation with sharpening, which effectively acts as a high-pass filter. From the results shown in the table below, we observe the following:\n- (a) Blurring $\\mathbf{x} + \\boldsymbol{\\delta}$ has a moderate effect in enhancing robustness, e.g., over the vanilla PhotoGuard. However, it also results in a notable drop in naturalness metrics compared to BlurGuard, as blurring the entire image erases high-frequency details from the image itself and thus compromises perceptual quality. In contrast, BlurGuard can avoid the issue by applying blur only to $\\boldsymbol{\\delta}$, preserving both robustness and visual fidelity.\n- (b) The adaptive sharpening scheme, implemented via unsharp masking [3], did not provide effective protection after purification. This is because sharpening rather amplifies high-frequency patterns, which can be easily suppressed by known purification techniques, e.g., JPEG compression. \n\nOverall, these results highlight our proposed adaptive blurring scheme as a more effective strategy, achieving both robustness and perceptual naturalness. We will incorporate these results in our final manuscript. \n|ImageNet-Edit| │ |**Naturalness**|||│|**Worst**|**case effect**||||\n|---|---|---|---|---|---|---|---|---|---|---|\n|**($\\varepsilon=16/255$)**| │|**LPIPS↓**|**SSIM↑**|**PSNR↑**|│|**FID↑**|**LPIPS↑**|**SSIM↓**|**PSNR↓**|**I.A.↓**|\n|PhotoGuard|│|0.34±0.11|0.70±0.11|28.2±0.32|│|92.21|0.27±0.07|0.73±0.10|29.9±1.07|0.94±0.04|\n|**BlurGuard**|│|**0.21±0.10**|**0.93±0.09**|31.1±2.29|│|**107.88**|**0.32±0.09**|**0.70±0.09**|**28.8±0.42**|**0.92±0.05**|\n|└─blur($\\mathbf{x}+\\boldsymbol{\\delta}$)|│|0.32±0.11|0.79±0.08|**32.3±1.11**|│|98.45|0.30±0.07|0.71±0.10|30.1±1.21|0.94±0.04|\n|└─sharpen($\\boldsymbol{\\delta}$)|│|0.35±0.12|0.65±0.10|30.9±1.08|│|82.72|0.28±0.08|0.72±0.10|30.4±1.38|0.94±0.04|\n\n\n\n\n---\n\n**Q3. Editorial comments**\n\nThank you very much for your detailed reading. We agree that your editorial suggestions will help strengthen the clarity of our manuscript. We will thoroughly review all of your comments and incorporate them into the final draft, e.g., including the following points:   \nEquation (1) will be rewritten to separately define $L\\_{\\mathrm{enc}}$ apart from the $\\mathrm{argmin}$ formulation.\nThe distance notations will be clarified, e.g., by standardizing the use of $\\epsilon$ in place of $\\eta$ for consistency.\nA simplified version of Algorithm 1 will be incorporated into the main text.\nThe font sizes of Figure 2 and 4 will be increased to improve readability.\n\n---\n\n**Q4. Figure 4: “Worst-case gap”?**\n\nWe use the term “worst-case gap” in Figure 4 to refer to the drop in protection effectiveness (e.g., in LPIPS) between a protected image before and after the strongest purification attempt among those considered. In other words, it measures how much the protection effect is weakened by the strongest purification. Therefore, the small worst-case gaps of BlurGuard in Figure 4 show that its protections remain robust even under aggressive purification attacks. This trend holds consistently across a wide range of protection budgets; e.g., including those from $\\epsilon=\\tfrac{1}{255}$, as you mentioned, up to $\\epsilon=\\tfrac{16}{255}$. We will clarify this point in the final draft. \n\n---\n\n[1] Liang et al., Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. ICML 2023. \\\n[2] Liang & Wu, Mist: Towards improved adversarial examples for diffusion models. 2023. \\\n[3] Polesel et al., Image enhancement via adaptive unsharp masking. IEEE TIP 2000.\n\n---"}, {"review_id": "9V59QtaDw1", "reviewer": "Reviewer_jjT1", "summary": "The paper tackles the problem that existing adversarial image-protection schemes are easily neutralised by simple post-processing such as JPEG compression or diffusion-based “purification”. The authors observe that many prior perturbations concentrate energy in high-frequency bands and are therefore easy to detect and strip away in the frequency domain. BlurGuard addresses this with two ingredients: (1) Per-region adaptive Gaussian blurring: using SAM masks, different σ values are learned for each semantic region so the perturbation’s spectrum better follows the underlying content. (2) Power-spectrum regularisation: an ℓ∞ penalty on the log-ratio between the RAPSD of the original and protected images keeps the overall spectrum “natural”.", "questions": "Please review the Weaknesses section. If all of my concerns are fully resolved, I’ll gladly raise my rating; if the assessment is still lacking, I may lower it instead.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "## Strengths\n1. Re-framing protection as spectral naturalness instead of pure imperceptibility is simple yet insightful.\n2. The paper is well written with clear figures.\n\n## Weaknesses\n1. The testing primarily relies on outdated UNet-based diffusion models. Experiments on modern models with MMDIT architecture and flow-matching training paradigms, such as SD3.5 [1], FLUX.Fill [2], or Step1X-Edit [3], would strengthen the evaluation.\n\n2. The authors should consider including a section on additional related work, as some studies, such as VINE [4] and Robust-Wide [5], focus on enhancing image watermark robustness to protect images against editing. These works are relevant to the authors’ research, particularly those analyzing image editing from a frequency perspective.\n\n3. The transferability analysis lacks persuasiveness, as SD 1.4 shares the same architecture and some training data with SD 2.1. Demonstrating that image protections optimized for SD-v1.4 are effective against models like FLUX.Fill [2] or Step1X-Edit [3] would provide more robust evidence of transferability.\n\n[1] [SD3.5](https://huggingface.co/stabilityai/stable-diffusion-3.5-large)\n\n[2] [Flux.Fill](https://huggingface.co/black-forest-labs/FLUX.1-Fill-dev)\n\n[3] [Step1X-Edit](https://github.com/stepfun-ai/Step1X-Edit)\n\n[4] [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://arxiv.org/abs/2410.18775)\n\n[5] [Robust-Wide: Robust Watermarking against Instruction-driven Image Editing](https://arxiv.org/abs/2402.12688)", "was_revised": true, "final_justification": "Thank you very much for your effort and thorough response. \n\nI have carefully read all the review comments as well as the authors’ responses. I believe the authors have adequately addressed my concerns, and I have raised my score.", "rebuttal": "We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.\n\n---\n\n**Q1. BlurGuard with MMDiT-based models**\n\nThank you for the suggestion. We agree that including evaluations on more recent models, e.g., the MMDiT-based architectures with flow-matching you mentioned, would further strengthen our work. Following your suggestion, we have extended our experiments to two additional models, viz., SD-v3.5 [1] and FLUX.1-dev [2], as shown in the following two tables. Overall, the results confirm again that BlurGuard offers the most effective protection against worst-case purification attempts, while also demonstrating the high adaptability of our framework. We will incorporate these additional results into the final draft, and continue to extend our evaluation to other models, e.g., Step1X-Edit [3] you also mentioned. \n\n**Table 1**: Comparison of image protection on ImageNet-Edit, tested on SD-v3.5 [1].\n\n| SD-v3.5 | │ | **Naturalness** |  |  | │ | **Worst** | **case effect** |  |  |  |\n|---|---|---|---|---|---|---|---|---|---|---|\n| **($\\varepsilon=16/255$)** | │ | **LPIPS↓** | **SSIM↑** | **PSNR↑** | │ | **FID↑** | **LPIPS↑** | **SSIM↓** | **PSNR↓** | **I.A.↓** |\n| PhotoGuard    | │ | **0.24±0.09**  | 0.79±0.09 | **31.5±1.30** | │ | $\\underline{\\text{121.58}}$ | 0.45±0.08 | 0.48±0.19 | 28.6±0.64 | **0.88±0.05** |\n| AdvDM         | │ | 0.28±0.10     | 0.77±0.08   | 29.5±0.26 | │ | 116.36      | 0.42±0.08   | 0.48±0.19   | 29.0±0.94   | $\\underline{\\text{0.89±0.05}}$ |\n| Mist          | │ | $\\underline{\\text{0.25±0.09}}$   | 0.80±0.09 | $\\underline{\\text{30.9±1.14}}$   | │ | 118.91 | 0.45±0.08 | 0.48±0.19 | 28.6±0.64 | **0.88±0.05** |\n| SDS           | │ | $\\underline{\\text{0.25±0.11}}$   | $\\underline{0.86±0.08}$ | 29.5±0.32 | │ | 119.20 | $\\underline{\\text{0.46±0.08}}$ | $\\underline{\\text{0.47±0.19}}$ | $\\underline{\\text{28.5±0.56}}$ | **0.88±0.05** |\n| **BlurGuard** | │ |$\\underline{\\text{0.25±0.10}}$ | **0.88±0.13** | 30.4±1.97 | │ | **125.32** | **0.48±0.07** | **0.46±0.18** | **28.4±0.46** | **0.88±0.05** |\n\n\n\n\n**Table 2**: Comparison of image protection on ImageNet-Edit, tested on FLUX.1-dev [2].\n\n| FLUX.1-dev               | │ | **Naturalness**      |   |   | │ | **Worst**       | **case effect** |   |   |   |\n|-----------------------------|---|----------------------|---|---|---|-----------------|-----------------|---|---|---|\n| **($\\varepsilon=16/255$)**  | │ | **LPIPS↓**           | **SSIM↑** | **PSNR↑** | │ | **FID↑**        | **LPIPS↑**       | **SSIM↓** | **PSNR↓** | **I.A.↓** |\n| PhotoGuard                  | │ | **0.21±0.10**        | 0.86±0.07 | 32.1±0.33 | │ | 80.22           | 0.28±0.06        | $\\underline{\\text{0.68±0.11}}$ | 29.5±0.31  | 0.91±0.05  |\n| AdvDM                       | │ | 0.27±0.10            | 0.85±0.07 | $\\underline{\\text{32.6±1.10}}$ | │ | 83.42           | 0.28±0.06        | $\\underline{\\text{0.68±0.12}}$ | 28.8±0.72  | $\\underline{\\text{0.90±0.05}}$ |\n| Mist                        | │ | 0.26±0.09            | 0.87±0.08 | 32.3±1.40 | │ | $\\underline{\\text{84.10}}$ | $\\underline{\\text{0.29±0.07}}$ | **0.67±0.12**        | 29.7±0.60  | $\\underline{\\text{0.90±0.04}}$ |\n| SDS                         | │ | 0.24±0.10            | $\\underline{\\text{0.88±0.08}}$ | 32.2±0.80 | │ | 81.65           | 0.28±0.06        | $\\underline{\\text{0.68±0.11}}$ | $\\underline{\\text{28.6±0.48}}$ | $\\underline{\\text{0.90±0.05}}$ |\n| **BlurGuard**               | │ | $\\underline{\\text{0.23±0.11}}$ | **0.89±0.07** | **33.4±2.90** | │ | **85.21**       | **0.30±0.10**   | **0.67±0.13**        | **28.4±0.33** | **0.89±0.05** |\n\n\n---\n\n**Q2. Additional related work**\n\nThank you for suggesting additional related works. For your information, we note that Appendix A.1 already includes a brief discussion on watermarking-based approaches, including the VINE work [4] you referred to. Nevertheless, we agree that providing a dedicated discussion on frequency-based methods explored in other lines of work, e.g., Robust-Wide [5] you mentioned, would help better contextualize our contributions. We will revise our manuscript to include an additional discussion of these related works in the main text of the final draft. \n\n---\n\n**Q3. Transferability analysis to different architectures, e.g., MMDiT?**\n\nFollowing your suggestion, we have additionally conducted black-box transfer experiments from SD-v1.4 to SD-v3.5 and FLUX.1-dev; both of which are based on MMDiT with flow-matching training, i.e., significantly diverging from SD-v1.4 in both architecture and training scheme. From the results summarized in the table below, we observe two key points: (a) BlurGuard consistently improves performance over the vanilla PhotoGuard across all metrics, showing the clear effectiveness of BlurGuard to enhance transferability; and (b) BlurGuard remains either the most effective or competitive across the board, further supporting general applicability of our approach. These observations confirm that our proposed framework offers a promising direction for improving the transferability of adversarial image protection methods. We will incorporate these additional results and the respective discussion in the final draft. \n\nImageNet-Edit|│|**SD‑v1.4**|$\\ \\ \\ \\ \\ \\rightarrow$|**SD‑v3.5**|||│|**SD‑v1.4**|$\\ \\ \\ \\ \\ \\rightarrow$|**FLUX1‑dev**|||\n|---|---|:---|:---|:---|:---|:---|:-:|:---|:---|:---|:---|:---|\n|**($\\varepsilon=16/255$)**|│|**FID↑**|**LPIPS↑**|**SSIM↓**|**PSNR↓**|**I.A.↓**|│|**FID↑**|**LPIPS↑**|**SSIM↓**|**PSNR↓**|**I.A.↓**|\n|PhotoGuard|│|112.58|0.40±0.09|0.48±0.18|29.1±0.85|0.90±0.04|│|$\\underline{\\text{72.60}}$|**0.26±0.08**|0.80±0.07|30.7±0.95|0.95±0.03|\n|AdvDM|│|98.25|0.34±0.10|0.71±0.09|29.9±1.04|0.92±0.04|│|71.74|**0.26±0.08**|**0.78±0.06**|30.6±1.06|$\\underline{\\text{0.94±0.04}}$|\n|Mist|│|**120.17**|0.43±0.08|0.47±0.19|28.8±0.83|$\\underline{\\text{0.89±0.05}}$|│|63.59|$\\underline{\\text{0.21±0.06}}$|0.80±0.06|$\\underline{\\text{30.3±0.87}}$|0.95±0.03|\n|SDS|│|102.12|0.41±0.09|0.52±0.14|29.4±0.88|$\\underline{\\text{0.89±0.05}}$|│|58.59|0.19±0.06|0.81±0.07|31.0±1.37|0.96±0.03|\n|**BlurGuard**|│|$\\underline{\\text{117.71}}$|**0.46±0.08**|**0.46±0.19**|**28.4±0.54**|**0.88±0.05**|│|**74.34**|**0.26±0.09**|$\\underline{\\text{0.79±0.09}}$|**29.0±0.69**|**0.93±0.04**|\n\n---\n\n[1] stabilityai/stable-diffusion-3.5-medium \\\n[2] black-forest-labs/FLUX.1-dev \\\n[3] Liu et al., Step1X-Edit: A Practical Framework for General Image Editing, 2025. \\\n[4] Lu et al., Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances, ICLR 2025. \\\n[5] Hu et al., Robust-Wide: Robust Watermarking against Instruction-driven Image Editing, ECCV 2024.\n\n---"}, {"review_id": "ROLiEO2QGz", "reviewer": "Reviewer_Zo4E", "summary": "This paper introduces a simple but effective method to enhance the robustness of image protection methods against noise reversal techniques, employing an adaptive Gaussian blur on the noise to adjust the overall frequency spectrum. Unlike previous efforts primarily focused on imperceptibility, this approach emphasizes the irreversibility of adversarial noise, making it difficult to detect as noise.", "questions": "*Please refer to the weaknesses mentioned above.*\n\n1. The ablation study indicates that \"Per-region adaptation\" might contribute less significantly compared to other modules. It would be beneficial to qualitatively show the different blur intensities across different regions for specific cases. Additionally, since the blur intensity depends on the semantic regions, a statistical correlation between specific semantic categories and their corresponding blur intensities may reveal interesting insights into how this module functions.\n2. Most inpainting methods mask edited regions during processing. A concern arises if the masked area is a region with strong adversarial noise; it's unclear if the proposed method would remain effective. The inpainting experiments (line 278) in this paper are limited to facial images and focus only on modifying areas around the face. However, real-world inpainting scenarios are far more diverse, with unpredictable manipulation regions. This limited experiment might not fully cover all types of inpainting tasks.\n3. More comprehensive details are needed for the ImageNet-Edit dataset. This includes clearer information about the prompts used and a statistic of image categories.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**:\n1. The paper offers a novel perspective by focusing on \"irreversibility\" rather than solely \"imperceptibility\" for image protection. And the proposed approach is surprisingly simple but effective.\n2. The method's effectiveness is thoroughly demonstrated through comprehensive experiments across various AI-generated scenarios and diverse noise purification techniques.\n\n**Weakness**:\n1. The ablation study indicates that \"Per-region adaptation\" might contribute less significantly compared to other modules. It would be beneficial to qualitatively show the different blur intensities across different regions for specific cases. Additionally, since the blur intensity depends on the semantic regions, a statistical correlation between specific semantic categories and their corresponding blur intensities may reveal interesting insights into how this module functions.\n2. Most inpainting methods mask edited regions during processing. A concern arises if the masked area is a region with strong adversarial noise; it's unclear if the proposed method would remain effective. The inpainting experiments (line 278) in this paper are limited to facial images and focus only on modifying areas around the face. However, real-world inpainting scenarios are far more diverse, with unpredictable manipulation regions. This limited experiment might not fully cover all types of inpainting tasks.\n3. More comprehensive details are needed for the ImageNet-Edit dataset. This includes clearer information about the prompts used and a statistic of image categories.", "was_revised": true, "final_justification": "Based on the author's detailed rebuttal, which effectively addressed all of my concerns, and after considering the comments and discussions from other reviewers, I have decided to maintain my original score. I recommend the paper for acceptance.", "rebuttal": "We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.\n\n---\n\n**Q1. Further analysis on per-region adaptation**\n\nThank you for your thoughtful suggestion. We agree that a further analysis of the per-region adaptation module would enhance clarity. For your information, our extended ablation study in Appendix G provides a qualitative comparison between BlurGuard and the vanilla PhotoGuard, showing how BlurGuard adaptively allocates noise frequencies and produces perceptually natural perturbations. In the final draft, we will incorporate additional qualitative examples (e.g., more BlurGuard perturbations across different region types) and quantitative results (e.g., correlation between the learned $\\sigma$ values and semantic regions, as you suggested) to further improve clarity of the module.\n\n---\n\n**Q2. Inpainting under mask variability**\n\nAs you mentioned, our inpainting experiments primarily focus on “region-targeted” protection, where adversarial perturbations are selectively applied to the region intended for editing. We emphasize that this setup is practically motivated, as it reflects realistic misuse scenarios where a sensitive region, e.g., a person’s face, is kept intact while the surrounding areas are manipulated.\n\nThat said, we agree that real-world inpainting scenarios may involve unpredictable and diverse masking patterns. Indeed, this challenge has recently attracted attention in the literature; for example, DiffusionGuard [1], which we also include as a baseline, proposes the InpaintGuardBench dataset to benchmark robustness of image protection methods under mask variability. \n\nTo further address your concern, we conducted additional experiments on InpaintGuardBench, evaluating BlurGuard across six different masks per image, including both “seen” (used for protection) and “unseen” (novel at test time) masks. As shown in the table below, BlurGuard maintains strong protection performance across these mask variations, suggesting that BlurGuard not only provides robustness on the region-targeted setup but also generalizes well to more diverse inpainting scenarios. We will incorporate this discussion and the additional results into the final draft.\n\n\n\n| InpaintGuardBench | │ | **Naturalness** |  | │ | **Worst-case**| **effect**| |  |\n|---|-|---|---|-|--|---|---|---|\n| **($\\varepsilon=16/255$)** | │ | **LPIPS↓** | **SSIM↑** | │ | **FID↑ (Seen)** | **FID↑ (Unseen)** |  **│ PSNR↓ (Seen)** | **PSNR↓ (Unseen)** |\n| PhotoGuard     | │ | $\\underline{\\text{0.03±0.02}}$ | 0.96±0.02 | │ | 103.83 | 67.05 |│  37.2±14.2 | 35.5±8.2 |\n| AdvDM          | │ | $\\underline{\\text{0.03±0.02}}$ | 0.97±0.02 | │ | 125.66 | 71.06 |  │$\\underline{\\text{35.3±10.3}}$ | $\\underline{\\text{35.4±7.0}}$ |\n| Mist           | │ | **0.02±0.01** |  $\\underline{\\text{0.98±0.01}}$ | │ | 112.23 | 58.48 |  │37.1±14.2 | 36.4±9.8 |\n| SDS            | │ | 0.05±0.03 | 0.96±0.02 | │ | 113.30 | $\\underline{\\text{83.91}}$ |  │37.1±14.2 | 35.6±7.2 |\n| DiffusionGuard | │ |  $\\underline{\\text{0.03±0.02}}$ | 0.97±0.02 | │ | $\\underline{\\text{134.25}}$ | 61.32 |  │37.1±14.2 | 35.9±9.9 |\n| **BlurGuard**  | │ | $\\underline{\\text{0.03±0.02}}$ | **0.99±0.01** | │ | **140.82** | **90.32** |  │**34.9±17.0** | **35.3±8.9** |\n\n\n\n\n\n\n\n\n\n\n---\n\n**Q3. ImageNet-Edit: Additional details needed**\n\nThank you for the suggestion. We agree that providing additional clarification on the ImageNet-Edit dataset we constructed would enhance the reproducibility of our work. For your information, we note that we have included the full dataset as part of our supplementary material submission, along with the complete set of prompts used. We also plan to publicly release the dataset upon acceptance to further support reproducibility.\n\n---\n\n[1] Choi et al., DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR 2025.\n\n---"}]

Author rebuttal:

Meta-review: This paper presents a simple method for protecting an image against AI-based image editing. The idea extends existing perturbation-based protection methods to local regions by utilizing segmentation masks. Experiments demonstrate more effective protection over baselines. Overall, the paper is easy to understand and well motivated. The reviewers requested several additional experiments, which the authors have addressed; hence, the reviewers are supportive of this paper. The AC agrees with this evaluation.
Decision: Accept (poster)