Rethinking and Defending Protective Perturbation in Personalized Diffusion Models

Authors: Yixin Liu, Ruoxi Chen, Xun Chen, Lichao Sun
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Protective Perturbations, Imperceptible Perturbations, Adversarial Purification, Diffusion-based Generative Models

Abstract:
Personalized diffusion models (PDMs) have become prominent for adapting pre-trained text-to-image models to generate images of specific subjects using minimal training data. However, PDMs are susceptible to minor adversarial perturbations, leading to significant degradation when fine-tuned on corrupted datasets. These vulnerabilities are exploited to create protective perturbations that prevent unauthorized image generation. Existing purification methods attempt to red-team the protective perturbation to break the protection but often over-purify images, resulting in information loss. In this work, we conduct an in-depth analysis of the fine-tuning process of PDMs through the lens of shortcut learning. We hypothesize and empirically demonstrate that adversarial perturbations induce a latent-space misalignment between images and their text prompts in the CLIP embedding space. This misalignment causes the model to erroneously associate noisy patterns with unique identifiers during fine-tuning, resulting in poor generalization. Based on these insights, we propose a systematic red-teaming framework that includes data purification and contrastive decoupling learning. We first employ off-the-shelf image restoration techniques to realign images with their original semantic meanings in latent space. Then, we introduce contrastive decoupling learning with noise tokens to decouple the learning of personalized concepts from spurious noise patterns. Our study not only uncovers fundamental shortcut learning vulnerabilities in PDMs but also provides a comprehensive evaluation framework for developing stronger protection. Our extensive evaluation demonstrates its superiority over existing purification methods and stronger robustness against adaptive perturbation.

Decision: reject
Reviewer scores: 6, 8, 6, 3

Reviews and discussion:
<thread>
creation date:
1730154890291

thread_type:
official_review

<thread_object>
creator: reviewer_urze

<content>
summary:
This paper proposes viewing the fine-tuning process of Personalized Diffusion Models (PDMs) through the lens of shortcut learning, using causal analysis as motivation. The authors then introduce a defense framework designed to enable the model to correctly associate images with their original semantic meanings.

strengths:
The paper provides preliminary experiments on CLIP, which help demonstrate the authors' ideas.
Personalized diffusion models present an interesting area for further exploration.

weaknesses:
1. The paper lacks overall coherence, with some sections difficult to follow and, in some cases, contradictory. Additionally, several terms and graphs are missing clear definitions and explanations.

    1. Are "adversarial perturbations" and "protective perturbations" intended to be the same concept? The author seems to use these terms interchangeably; if they differ, please clarify each term carefully.
    2. In the introduction, the author presents multiple related works. It may be helpful to focus on those most relevant to the paper’s main motivation. Additionally, certain terms, such as "purification studies," would benefit from brief explanations—similar to the way "image purifications" is introduced on line 142.
    3. Several equations need further explanation, such as those on lines 178-179, regarding the function of an instance dataset and a class dataset. Additionally, the meaning of "r" on line 208 is unclear.

2.After reading the entire paper, I found it challenging to identify the specific question the author aims to address and the associated motivations. While the introduction attempts to outline these points, it is difficult to discern the relationship between the motivation and the problem being addressed. Additionally, there appears to be a disconnect between the problem definition in the introduction and the methods presented. Here are some specific suggestions for clarification:

    1. The introduction states, “The model trained on perturbed data will generate images that are poor in quality, and thus, unauthorized fine-tuning fails.” Does this imply that generating low-quality images of private content protects copyright and privacy? If so, why does the proposed method focus on enhancing image clarity for private content while defining it as a defense?
    2.The author mentions that shortcuts are key to avoiding the generation of private personal images. Given this, why does the method seem to eliminate these shortcuts?
    3.On line 46, adversarial perturbations are suggested as a means to protect users’ images from unauthorized personalized synthesis. However, line 100 describes an intention to "defend against" this. Could you clarify?
    4.Additionally, the highlighted question in the introduction, “How to design an effective, efficient, and faithful purification approach is still an open question,” lacks context. Although there is a mention of “Moreover, purification studies are also purposed to further break those protections” in the following sentence, there are no subsequent explanations, particularly concerning how this question connects with the paragraph's earlier discussion.
    5. In the end of introduction, it seems that the authors propose a new purify methods, "Our approach conducts comprehensive purification from three perspectives, including input image purification, contrastive decoupling learning with the negative token, and quality-enhanced sampling....". However, in the methods, the author says they propose a method to address the short cut learning...., which is a little bit confusing.

3. Minor: Although viewing fine-tuning from a causal effect and shortcut learning perspective is novel, it shares similarities with backdoor attacks. In the backdoor attack literature, several papers have employed causal graphs to analyze shortcut mechanisms.[1-3]

4. The causal graph is underexplained and possibly contains ambiguities. For example, the definitions of $\bar{C}$ and $\bar{x_o}$ are missing. While a brief introduction to the construction of the graph is provided, explanations of each node’s meaning and the meaning of the arrows are absent. Given that the causal graph is a key contribution, adding a paragraph to introduce and explain it in detail would be beneficial. The term "spurious path" may also be misapplied; in causal inference, this usually refers to a backdoor path between treatment and outcome. Since this doesn’t apply here, either avoid the term or define it within the paper’s context.

5. The causal graph may need structural revision. In causal inference, an arrow between A and B signifies that A causes B. However, in this graph, it seems that an arrow signifies containment rather than causation. I would suggest adhering closely to causal inference conventions and adjusting the graph accordingly.

[1]Zhang Z, Liu Q, Wang Z, et al. Backdoor defense via deconfounded representation learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 12228-12238.

[2]Liu Y, Xu X, Hou Z, et al. Causality Based Front-door Defense Against Backdoor Attack on Language Models[C]//Forty-first International Conference on Machine Learning.

[3]Hu M, Guan Z, Zhou Z, et al. Causality-Based Black-Box Backdoor Detection[J].

questions:
See weakness
</content>
</thread_object>

</thread>
<thread>
creation date:
1730347759309

thread_type:
official_review

<thread_object>
creator: reviewer_2twg

<content>
summary:
The paper conduct a comprehensive analysis to show that perturbations induce a latent-space misalignment between images and their text prompts in the CLIP embedding space, which leads to association between the noise patterns and the identifiers. Based on this observation, the paper introduces contrastive decoupling learning with noise tokens to decouple the learning of personalized concepts from spurious noise patterns.

strengths:
1. The observation that adversarial perturbations induce a latent-space misalignment between images and their text prompts in the CLIP embedding space is interesting and insightful.

2. The paper is well-organized and easy-to-follow.

3. The paper conducts an extensive array of experiments and also considers adaptive perturbation.

weaknesses:
1. The paper does not provide strong theoretical analysis to support the conclusions.

2. The technical contribution is a little limited since Decoupled Contrastive Learning is not a new technique proposed by the paper.

questions:
I am wondering if the noisy images generated by DM without any defense can be denoised?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730550920873

thread_type:
official_review

<thread_object>
creator: reviewer_co1c

<content>
summary:
This paper uncovers and validates the underlying mechanism by which adversarial perturbations disturb the fine-tuning of personalized diffusion models by latent-space image-text misalignment. Then, it introduces a systematic defense framework that mitigates the misalignment with data purification and contrastive decoupled learning and sampling.

strengths:
- This paper finds that adversarial perturbation leads to latent image-text mismatch and provides an explanation from the perspective of shortcut learning. Their analysis contributes to the further development of protective perturbation in personalized diffusion models.
  
- The proposed framework provides a system-level defense covering data purification, model training, and sampling strategy. Compared with previous data transformation and diffusion-based methods, the proposed method achieves the best semantic and image quality restoration.

weaknesses:
- In Table I, the authors would better add a setting that the clean images are processed by the proposed and baseline methods.
  
- In Table II, why only calculate the time for data purification? Will CDL incur additional time costs?

questions:
Please help to check weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730697321022

thread_type:
official_review

<thread_object>
creator: reviewer_nipz

<content>
summary:
The paper aims to improve the personalization performance of Diffusion Models on images with protective perturbation, a kind of noise avoiding images to be learned by models. The authors fist empirically analyze the latent mismatch between the perturbed and original images, finding that perturbation significantly alternate the latent representations of images. The authors believe that the mismatch causes shortcut learning and therefore fail the personalization of diffusion models on such perturbed data. Therefore, a novel method is proposed to improve the personalization training by contrastive learning and super resolution.

strengths:
1. The proposed contrastive learning method is well motivated by the empirical finding on the latent mismatch of perturbed images.
2. In multiple domains, the method presents better fine-tuning performance than baselines given protective perturbation on images.
3. Comprehensive experiments are conducted to understand and evaluate the method.

weaknesses:
1. It is not clear to me the connection between the latent mismatch and the shortcut learning. Why does the existence of latent mismatch lead to shortcut learning? 
2. I don't think the word "defending" (in the title) should be used against a good technique, protective perturbation. The paper is a good red-teaming paper that explored a stronger threat model for protective perturbation. Unfortunately, many description of the method is defined as a mitigation method, which could mislead the readers about the negative impacts of the methods. The authors should discuss how this method can break the existing protective perturbation. It would be appreciated if the authors can discuss potential solutions toward better copyright protection via protective perturbation or other alternatives.

questions:
* It is not clear to me the connection between the latent mismatch and the shortcut learning. Why does the existence of latent mismatch lead to shortcut learning? 
* What are the potential mitigation against to the proposed method?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732143278232

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response

comment:
We greatly appreciate all reviewers for your time and effort in providing this insightful feedback that helps us improve our work. We have submitted a revised version of the paper that highlights the changes in blue color. In this post, we provide a general response summary to the most common questions and the main updates in our revision.

### Response Summary to Common Questions

> Q1: Analysis and connection between latent mismatch and shortcut learning (Reviewer `nipZ`, `2TWg`)

**Response**: We provide a more detailed explanation of how latent mismatch leads to shortcut learning. In Section 4.1, we demonstrate that protective perturbation transforms the target to $X_0^\prime = X_0 + \Delta$, causing semantic displacement in the latent space toward noise patterns rather than preserving the original identity concept. Given the architectural constraints of Dreambooth learning, where $\mathcal{V}^*$ must associate with either noise or identity concept, the model naturally converges to learning spurious correlations between $\mathcal{V}^*$ and $\Delta$ as this represents the path of least resistance for loss minimization.

---

> Q2: Positioning and framing of the work as red-teaming protective perturbations rather than safeguarding them (Reviewer `uRZe`, `nipZ`)

**Response**: We appreciate the feedback about the positioning of our work. We have made several important revisions:

- Updated the "Defending" in title to "Red-Teaming" to better reflect our positioning to avoid confusion. 
- Clarified throughout the paper that our work is a red-teaming effort aimed at understanding and further breaking protective perturbations.
- Updated the introduction to focus on the two key related works, including IMPRESS and GrIDPure, clarifying terminology, and maintaining consistent terminology around "protective perturbations".

---

> Q3: Technical novelty of contrastive decoupling learning and comparison with existing work in backdoor defense (Reviewer `uRZe`, `2TWg`)

**Response**: While decoupling learning exists in backdoor defense literature [1] as pointed out by reviewer `uRZe`, our approach differs substantially in both problem space and technical implementation from CBD [1]. We believe that our work makes a novelty contribution in terms of methodology and also findings. We summarize the main difference with CBD [1] here for reviewers' convenience: 
1. We address fundamentally different challenges than previous work like CBD [1]. CBD focuses on backdoor attacks in classification tasks, where attackers introduce input-side confounders to trigger specific label predictions, whereas our work tackles personalized generation in text-to-image diffusion models where protectors modify the learning target ($X_0^\prime=X_0+\Delta$) to link identifiers ($\mathcal{V}^*$) with subject concepts.
2. Our technical approach achieves decoupling more efficiently through prompt augmentation that capitalizes on inherent differences between class-specific and instance-specific images. In CBD, decoupling is achieved through feature space decoupling through mutual information minimization between early-stop and clean models. However, our approach achieves more efficient decoupling through prompt augmentation by leveraging the inherent differences between class-specific and instance-specific images. We introduce a noise identifier $\mathcal{V}^*_N$ and use "with"/"without" prefixes for contrastive decoupling learning, eliminating the need for model weight access or complex early-stopping parameters that CBD requires.

Please refer to Appendix E.1 in the revised manuscript for more discussion with existing work in backdoor defense.

---

### Change Summary in the Revised Version
1. Improved introduction by focusing on the two key related works, including IMPRESS and GrIDPure, clarifying variables like $r, \bar{c},\bar{X_0}$, and maintaining consistent terminology around "protective perturbations". (`uRZe`)
2. Updated the causal graph in Figure 2 and Figure 9 with more detailed construction details in Appendix C following the conventional notation in causal inference. (`uRZe`)
3. Enhanced clarity throughout the paper regarding our positioning as a red-teaming effort. (`uRZe, nipZ`)
4. Expanded discussion in Section 4.1 to better explain the connection between latent mismatch and shortcut learning. (`uRZe, nipZ`)
5. Added detailed comparison with related work in backdoor defense in Appendix E.1. (`uRZe, 2TWg`)
6. Added comprehensive discussion of alternative copyright protection approaches in Appendix E.2. (`nipZ`)
7. Added results under the clean setup in Table 1 to evaluate purification methods' performance without protective perturbations. (`co1c`)
8. Added post-hoc purification results on noisy outputs in Appendix B.6 and Figure 8. (`2TWg`)
9. Added discussion on broader impact and more adaptive protection in Appendix B.5. (`nipZ, co1c`)

**References:**

`[1]`. "Backdoor defense via deconfounded representation learning." CVPR'23
</content>
</thread_object>

</thread>
<thread>
creation date:
1732483544260

thread_type:
official_comment

<thread_object>
creator: area_chair_wrmw

<content>
comment:
Dear reviewers,

Thanks for serving as a reviewer. As the discussion period comes to a close and the authors have submitted their rebuttals (maybe in general response), I kindly ask you to take a moment to review them and provide any final comments.

If you have already updated your comments, please disregard this message.

Thank you once again for your dedication to the OpenReview process.

For authors, I think it will be better to also respond to each reviewer separately, as it will be easier for reviewers to find whether their own concerns have been addressed.

Best,

Area Chair
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper proposes  a view for the fine-tuning process of Personalized Diffusion Models (PDMs) as shortcut learning, motivated by causal analysis. The authors introduce a defense framework to help the model correctly associate images with their original semantic meanings.

Strength:
1. The paper studies why protective noise works in T2I models.

2. The paper conducts an extensive array of experiments and also considers adaptive perturbation.

Weaknesses:

The authors and reviewers discuss about the causal analysis in this paper and even the authors agree that their causal analysis is not strict. I think this greatly weaken this paper bacuase of the following reasons, 1. short-cut analysis are not a newly proposed term in unlearnable exmaple, and classification also has "class-image feature misalignment". Due to this reason, I believe the authors need to add some new insights to make this paper stand out, like causal analysis. Therefore, their causal analysis should not be just drawing some causal graphs. 2. In the paper's contribution, the causal analysis also mentioned a lot by the authors. Therefore, I think the authors should do in-depth analysis to demonstrate their analysis are correct.

Therefore, I think this paper still need a lot modifications before the acceptance.