Title: IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based  Generative AI
Venue: NeurIPS 2023
Accepted: yes
Keywords: Image Generation Godels

Latent Diffusion Models

Image Purifying
Abstract: Diffusion-based image generation models,  such as Stable Diffusion or DALL·E 2, are able to learn from given images and generate high-quality samples following the guidance from prompts. For instance, they can be used to create artistic images that mimic the style of an artist based on his/her original artworks or to maliciously edit the original images for fake content. However, such ability also brings serious ethical issues without proper authorization from the owner of the original images. In response, several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations, which are designed to mislead the diffusion model and make it unable to properly generate new samples. In this work, we introduce a perturbation purification platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure.
IMPRESS is based on the key observation that imperceptible perturbations could lead to a perceptible inconsistency between the original image and the diffusion-reconstructed image, which can be used to devise a new optimization strategy for purifying the image, which may weaken the protection of the original image from unauthorized data usage (e.g., style mimicking, malicious editing).
The proposed IMPRESS platform offers a comprehensive evaluation of several contemporary protection methods, and can be used as an evaluation platform for future protection methods.

IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI

Abstract

Diffusion-based image generation models, such as Stable Diffusion or DALL·E 2, are able to learn from given images and generate high-quality samples following the guidance from prompts. For instance, they can be used to create artistic images that mimic the style of an artist based on his/her original artworks or to maliciously edit the original images for fake content. However, such ability also brings serious ethical issues without proper authorization from the owner of the original images. In response, several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations, which are designed to mislead the diffusion model and make it unable to properly generate new samples. In this work, we introduce a perturbation purification platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure. IMPRESS is based on the key observation that imperceptible perturbations could lead to a perceptible inconsistency between the original image and the diffusionreconstructed image, which can be used to devise a new optimization strategy for purifying the image, which may weaken the protection of the original image from unauthorized data usage (e.g., style mimicking, malicious editing). The proposed IMPRESS platform offers a comprehensive evaluation of several contemporary protection methods, and can be used as an evaluation platform for future protection methods.

1 Introduction

Diffusion-based image generation models, e.g., Stable Diffusion (Rombach et al., 2022b) and DALLE 2 (Ramesh et al., 2022), have gained increasing attention due to their exceptional performance in synthesizing high-quality samples by leveraging given images. Despite their superior performance, existing studies (Shan et al., 2023) showed that they could be abused to generate new images without proper authorization from the original data owner. For instance, they could be used to learn from the original artworks of a specific artist and generate artistic images that mimic his/her style without authorization, which may lead to violation of intellectual property or copyrights (Dixit, 2023; Joseph Saveri Law Firm LLP, 2023; Edwards, 2022). They can also be used to maliciously edit the images

Changjiang Li

Jinyuan Jia

Image Editing, Prompt: 'A person in an airplane'

Source:

Sample1:

Sample2:

Task:

of celebrities downloaded from the Internet to create disinformation (Pranav Dixit, 2023; Li et al., 2022a). Those unauthorized data usage without the consent from the original data owner creates severe ethical concerns and causes profound societal harm (Shan et al., 2023).

To prevent unauthorized data usage, some recent studies (Shan et al., 2023; Salman et al., 2023) proposed to add imperceptible perturbations to images such that the latent diffusion model (LDM) (Rombach et al., 2022b), a state-of-the-art diffusion-based image generation model, is not able to leverage perturbed images to generate high-quality samples. For instance, PhotoGuard (Salman et al., 2023) proposed to add imperceptible perturbations to the images such that LDMs cannot generate realistic images when attempting to edit upon the perturbed image. GLAZE (Shan et al., 2023) proposed to add imperceptible perturbations to the artworks of an artist such that the LDMs cannot learn from perturbed images to generate samples that mimic the style of the artist. These works share a common trait: they all aim to add imperceptible perturbations to the original images to protect them from being 'correctly' processed by the LDMs without proper authorization.

Although those protection methods (Shan et al., 2023; Salman et al., 2023) show some promising demos on preventing unauthorized data usage, we still lack a systematic understanding of their robustness and practical performances. For instance, since the perturbations added by those methods are imperceptible, we could potentially purify a perturbed image to disable its perturbation.

In this work, we aim to bridge the gap by conducting a systematic examination of those protection methods. We argue that this examination is essential from two aspects. First, the effectiveness of those protection methods under strong, adaptive perturbation purification is unknown. As a result, the examination could help users obtain a better understanding on the effectiveness of those protection methods in different scenarios. Second, the examination could also shed light on the design of new protection methods. The developed system can also be used as an evaluation platform for testing the effectiveness of future protection methods.

Our key observation is that the current 'successful' imperceptible perturbations usually lead to a perceptible inconsistency between the original image and the diffusion-reconstructed image (i.e., the image-to-image output of the LDM without given any prompt), which can be used to devise a new optimization strategy for purifying the image and disabling the added perturbation. Specifically, we derive two conditions that the purified image should satisfy: similarity condition and consistency condition . The similarity condition suggests that the purified image should be visually close to the perturbed image, and thus visually close to the original image (since the perturbation is imperceptible). The consistency condition means that the reconstructed image by a LDM for the purified image should be similar to itself. This condition stems from the observations that the clean image can reconstruct the original image and satisfy such consistency condition while the perturbed image cannot. We defer the detailed derivation of those two conditions to Section 4. Given those two conditions, we respectively design two losses to quantify them, enabling us to formulate the purification of a

perturbed image as an optimization problem. Finally, we solve the optimization problem and obtain the purified image. In summary, our contributions are as follows:

We have explored and analyzed existing protection methods for unauthorized data usage in diffusion models and pointed out the potential risks. We found that existing methods heavily rely on adding an imperceptible perturbation. Yet such an imperceptible perturbation usually leads to a perceptible inconsistency between the original image and the diffusion-reconstructed image.

Based on the empirical findings, we propose IMPRESS , i.e., IM perceptible P erturbation RE moval S y S tem, a new platform for evaluating the effectiveness of imperceptible perturbations as a protective measure by purifying a perturbed image with consistency-based losses.

We also test the effectiveness of adaptive protection designs which also feature our consistencybased loss upon those existing protection methods. We find that it is difficult to generate effective imperceptible perturbations through such a simple adaptive design, highlighting the need for more advanced methods to prevent unauthorized data usage in LDMs.

2 Related Works

Diffusion-based Image Generation Systems. Recently, Diffusion Probabilistic Models (DPMs) (Ho et al., 2020) have achieved impressive results in the field of image generation (Croitoru et al., 2023), including applications such as unconditional image generation(Ho et al., 2020; Nichol and Dhariwal, 2021; Song et al., 2020a), text-to-image synthes (Shi et al., 2022; Rombach et al., 2022a; Saharia et al., 2022b), image-to-image translation (Wolleb et al., 2022; Li et al., 2022b; Wang et al., 2022; Zhao et al., 2022; Saharia et al., 2022a), image editing (Avrahami et al., 2022; Meng et al., 2021), and image inpainting(Lugmayr et al., 2022; Bugeau and Bertalmio, 2009). DPMs typically employ a U-Net (Ronneberger et al., 2015) architecture as the underlying neural backbone, which naturally adapts to image-like data (Dhariwal and Nichol, 2021; Ho et al., 2020; Song et al., 2020b; Ronneberger et al., 2015).

Latent Diffusion Models. In image generation tasks, training and evaluating DPMs in the original image feature space can lead to low inference speed and high training costs. Recent works have been trying to address this issue by using advanced sampling strategies (Song et al., 2020a; Kong and Ping, 2021; San-Roman et al., 2021), hierarchical approaches (Ho et al., 2022; Vahdat et al., 2021), and feature compression strategy (Rombach et al., 2022b). Among them, latent diffusion model (Rombach et al., 2022b) employs a pre-trained image encoder and decoder, enabling the DPM to work in a compressed, low-dimensional latent space, thus reducing the computational cost of training and accelerating inference speed while maintaining almost the same quality of synthesized images.

Unauthorized Data Usage in Diffusion Models. The powerful image generation and editing capabilities of AI have also raised ethical concerns, including malicious image editing (Goodfellow et al., 2014; Mirza and Osindero, 2014; Salimans et al., 2016; Isola et al., 2017; Zhu et al., 2017; Zhang et al., 2017; Karras et al., 2018; Brock et al., 2019; Karras et al., 2019; Rombach et al., 2022b; Ramesh et al., 2022) or training image generation models using unauthorized images from artists and mimicking their styles (Shan et al., 2023). Some works have attempted to address this issue, such as removing certain knowledge from models (Gandikota et al., 2023) or making images unlearnable or uneditable (Huang et al., 2021; Fu et al., 2021; Shan et al., 2023; Salman et al., 2023). However, other studies argue that such imperceptible perturbations are fragile (Radiya-Dixit et al., 2021b).

3 Preliminaries

We briefly introduce the preliminaries on Latent Diffusion Models (Rombach et al., 2022b) and existing protection methods (Salman et al., 2023; Shan et al., 2023).

Latent Diffusion Models (LDMs). Latent diffusion model (Rombach et al., 2022b) aims to train the diffusion model on a lower-dimensional latent space to generate high-quality samples while saving computation costs. Moreover, it can utilize additional information, such as text, to guide the generation process, enabling it to generate or edit images with guidance from a prompt (e.g., a text). Given an image x , LDM first uses an image encoder E to embed it into a latent representation, i.e., z = E ( x ) and then perform T forward diffusion steps by progressively adding Gaussian noise ϵ ∼ N ( 0 , I ) , to the latent space. For simplicity, we use z 1 , z 2 , · · · , z T to denote latent representations at each forward diffusion step. Suppose we have a prompt y (e.g., a certain text phrase), a feature extractor τ θ

and we denote the embedding of y as τ θ ( y ) . The goal of the LDM is to train a conditional denoising network ϵ θ , e.g., a UNet (Ronneberger et al., 2015), to model the conditional distribution p ( z | y ) by gradually recovering z from z T based on τ θ ( y ) . Suppose ϵ θ ( z t , t, τ θ ( y )) is the Gaussian noise estimated in the t -th step. We can train ϵ θ based on the following loss:

Suppose ˜ z is the latent representation obtained after T denoising steps. We can use an image decoder D to obtain the generated image ˜ x based on ˜ z , i.e., ˜ x = D ( ˜ z ) . For simplicity, we denote the end-toend framework to obtain ˜ x based on x and y as ˜ x = f LDM ( x ; y ) . Given a prompt, LDMs can be used to generate a sample or edit an image. Note that when there is no prompt y , the LDM reconstructs its input image x , i.e., x would be very similar to f LDM ( x ) .

PhotoGuard. PhotoGuard (Salman et al., 2023) proposes to add carefully crafted perturbations to an image before making it publicly available (e.g., uploading it to the Internet) to raise the cost of malicious image editing. When using LDMs to edit the perturbed images, the output is usually less realistic. Specifically, PhotoGuard proposes two approaches: encoder attack and diffusion attack .

The goal of the encoder attack is to add a perturbation δ enc to an image x such that the image encoder E produces similar outputs for x + δ enc and a target image x target (e.g., a pure gray image or random noise). Formally, δ enc can be obtained by solving the following optimization problem:

where ∆ is the L ∞ norm perturbation budget. The noise added to the image could be imperceptible to human eyes when ∆ is small. Thus when LDMs are used to edit x + δ enc, the resulting output would be similar to the target image instead. The diffusion attack , on the other hand, is more direct and aims to craft a perturbation δ diff such that the output of the LDM is similar to x target :

Compared to the encoder attack which only targets the image encoder, the diffusion attack considers the whole LDM model with prompts, achieving better empirical performance but is less efficient.

GLAZE. GLAZE (Shan et al., 2023) aims to add perturbations to the artworks of an artist such that LDMs cannot learn the correct style of the artist from perturbed artworks. Given an image x , GLAZE first chooses a target style T that is sufficiently different from the style of x . Then, GLAZE transfers x to the target style T using a pre-trained style transfer model Ω . For simplicity, we use Ω( x , T ) to denote the style-transferred image. Given Ω( x , T ) , GLAZE crafts the perturbation δ GLAZE by solving the following optimization problem:

where LPIPS (Learned Perceptual Image Patch Similarity) (Zhang et al., 2018) measures userperceived image distortion, ∆ L is the perturbation budget, and λ is a hyper-parameter adjusting the strength of the LPIPS regularization term. Roughly speaking, GLAZE aims to perturb images (e.g., artworks of an artist) such that a LDM generates samples with the target style instead of the original style when learning from the perturbed images.

4 Proposed Method

In this section, we formally study the potential vulnerabilities in existing protection methods and discuss our proposed method to disable perturbations added by those methods.

4.1 Analyzing Potential Vulnerabilities of Existing Methods

We notice that existing protection methods (e.g., PhotoGuard and GLAZE) all aim to add imperceptible perturbations such that LDMs cannot 'correctly' learn or process the perturbed image for style mimicking or malicious editing. While such perturbations certainly raise the cost of unauthorized data usage, it is not flawless. Specifically, one special use case of LDM is to let it reconstruct the image, i.e., let an image x run through the entire LDM (encoder, forward diffusion, backward diffusion,

Clean Image:

𝑓𝑓

𝐿𝐿𝐿𝐿𝐿𝐿

≈

Consistent

Protected Image:

𝑓𝑓

𝐿𝐿𝐿𝐿𝐿𝐿

≠

Inconsistent!

decoder) without any prompt. In such a case, the output of the LDM (denoted by f LDM ( x ) ) should be close to the original input x . However, since the imperceptible perturbations are able to deceive the LDMs (to believe that the image is from another style or that the image's latent embedding is close to a target image), its reconstruction result f LDM ( x ptb ) may no longer be close to the perturbed input x ptb. Rather, it could become similar to a target image or target style instead.

Figure 2 shows an example painting by Claude Monet and its protected version by GLAZE (Shan et al., 2023). When using LDMs to reconstruct the two images respectively, we can observe that the protected image leads to noticeable inconsistency after reconstruction while the clean image stays roughly the same. In other words, the reconstructed version of the perturbed image is no longer close to itself, rather, it is more close to the targeted style (e.g., Cubism by Picasso). By contrast, a clean image and its reconstructed version do not have such inconsistency. This inspires us to leverage the inconsistency to purify the perturbed image to disable such imperceptible perturbations.

4.2 Our Proposed Method

Based on our previous empirical findings, given a perturbed image x ptb created by existing protection methods via imperceptible perturbations, we aim to purify the perturbed image to disable its perturbation. We first derive the two conditions that the purified image x pur should satisfy, then formulate IMPRESS , i.e., IM perceptible P erturbation RE moval S y S tem, as an optimization problem based on those two conditions and provide our solution to solve it, and finally show our complete algorithm.

Two conditions for purified image. The purified image x pur should satisfy two conditions: similarity condition and consistency condition . Next, we respectively derive them.

Similarity condition. Our ultimate goal is to make sure the purified image x pur stays visually close to the original image x , i.e., x pur ≈ x . Recall that existing methods (Salman et al., 2023; Shan et al., 2023) aim to add an imperceptible perturbation to a given image x to craft a perturbed image x ptb (see Section 3 for details). Therefore, the perturbed image x ptb is already close to the original image x . Based on this observation, since we only have access to the perturbed image x ptb, requiring the purified image x pur to stay visually close to the perturbed image x ptb would be sufficient to guarantee x pur ≈ x . This leads to similarity condition .

Consistency condition. As our goal is to find a purified image x pur close to the original image x , x pur should share some similar traits as x . Our observation in Section 4.1 suggests that a clean image can stay roughly the same after diffusion-reconstruction while the perturbed image cannot. Therefore, to make x pur close to x , we also require the purified image x pur to be able to reconstruct itself using LDMs, i.e., x pur ≈ f LDM ( x pur ) . This leads to consistency condition .

Formulating IMPRESS as an optimization problem. Our key idea is to define two losses that respectively quantify the similarity condition and consistency condition.

Quantifying similarity condition. Our similarity condition means that x pur would be visually close to x ptb. Following previous studies (Shan et al., 2023), we use LPIPS (Learned Perceptual Image Patch Similarity) (Zhang et al., 2018) to quantify the visual difference between x pur and x ptb. Formally, we have the loss max( LPIPS ( x pur , x ptb ) -∆ L , 0) , where ∆ L is the perceptual perturbation budget. We note that LPIPS is widely adopted in various fields (Cherepanova et al.,

𝐱𝐱ptb

𝐱𝐱pur

𝐱𝐱

(

inaccessible

)

Input

After

𝒟𝒟

(

ℰ

(

·

))

consistency

loss

ℰ

𝒟𝒟

≈

≈

similarity loss

≠

≈

≈

2021; Laidlaw et al., 2020; Rony et al., 2021) as it provides a measure of human-perceived image distortion. Compared to ℓ p -norm constraint, LPIPS offers more flexible constraint ranges. If the modified image still appears similar to the original image from a human perspective, it allows for larger changes in certain parts of the image, which aligns with our goal of preserving as much semantic information from x ptb as possible.

Quantifying consistency condition. Our consistency condition implies that x pur ≈ f LDM ( x pur ) . Intuitively, we can define the consistency loss as || x pur -f LDM ( x pur ) || 2 2 . However, it is very challenging to directly optimize this loss as it involves the complicated diffusion process (i.e., gradually adding and removing Gaussian noise). To address the challenge, we simplify the loss by removing the diffusion process in it. In particular, we define the loss || x pur -D ( E ( x pur )) || 2 2 to quantify the consistency condition, where E and D are the image encoder and decoder in the LDM. Note that || x pur -D ( E ( x pur )) || 2 2 can approximate || x pur -f LDM ( x pur ) || 2 2 as the goal of the diffusion process (without any prompt) is to reconstruct latent representation. Moreover, such approximation enables us to solve the optimization problem efficiently.

Combining the above two losses together, our final optimization problem is as follows:

where α is a hyper-parameter to balance the two losses. Given a perturbed image x ptb, the solution to the optimization problem in Eq. (4.1) is the purified image x pur. We use projected gradient descent to solve the optimization problem efficiently. In practice, we initialize x pur by x ptb plus an extra small Gaussian perturbation similar as in Madry et al. (2018). A summary of our proposed method is shown in Algorithm 1 in the Appendix.

5 Experiments

In this section, we conduct comprehensive experiments to demonstrate the effectiveness of the proposed method and verify its capability to disable imperceptible perturbations introduced by existing protection methods. Specifically, we evaluate against two protection methods on the specific tasks for which these methods were proposed: style mimicking and malicious editing of images .

5.1 Experimental Settings

Style Mimicking We conduct all the style mimicking experiments on the WikiArt dataset (Saleh and Elgammal, 2015). For GLAZE 1 (Shan et al., 2023), we essentially followed the settings of the

original paper and reproduced the code: given a victim artist V , we randomly select 124 of their works. We use ViT+GPT2 model to generate a title for each artwork and attach the victim artist V 's name to the generated title as our prompt y . Next, we randomly draw 24 works from these 124 art pieces as the style imitation training set, and the remaining 100 as the test set. We fine-tune a pre-trained LDM on the training set, and then generate new artworks mimicking the style of the victim artist by the prompt y .

Malicious Editing of Images For malicious editing of images , we utilize the code and settings made public by Photoguard (Salman et al., 2023). The purpose of malicious editing is to modify the background of a photo following the given malicious prompt. We conduct our experiments on the Helen (Le et al., 2012) dataset for this task. We selected the 80 images with the smallest face-to-image ratio from the Helen dataset and their corresponding face masks. Subsequently, we use Photoguard to generate protective noise for these images. Then, we attempt to modify the images using a latent diffusion model. We generate noise using the most powerful Diffusion attack-L2 method in Photoguard.

Baselines To show the effectiveness of IMPRESS is obtained through our consistency-based loss design, we also consider three other simple post-processing baselines: JPEG compression of the image, adding Gaussian noise to the image, and resizing the image. For JPEG compression, we set the quality factor as 15%. For adding Gaussian noise, we set the mean as 0 and the variance as 0.15. For the image resizing method, we first resize the 512 × 512 image to 256 × 256 , then resize it back to 512 × 512 .

5.2 Experimental Results on Style Mimicking

Table 1: Comparison of style mimicking performances when using fine-tuning data from clean images, GLAZE-protected images and post-processed protected images by our method and baselines. A higher accuracy suggests that the generated image style is close to the artist to be mimicked.

In Table 1, we present the experimental results for the task of Style Mimicking . To conduct the experiment, we fine-tune the pre-trained LDMs using clean data, GLAZE (Shan et al., 2023) protected data, and the post-processed data by our method as well as other baselines. We then use those finetuned models to generate new images mimicking the style of a certain artist and evaluate whether the generated image can successfully mimic the style of the artist. We consider two metrics for evaluating the generated image styles by constructing two image style classifier:

the CLIP classifier accuracy. Following the GLAZE paper (Shan et al., 2023), we use the pre-trained CLIP model (Radford et al., 2021) to build a style classier to measure whether the generated images belong to the genre of victim artist V . We treat the genre classification provided in the WikiArt dataset as the ground truth label, and use the intersection of the 27 historical genres and 13 digital genres from WikiArt, as candidate labels for the CLIP model.

the Diffusion classifier accuracy. We consider another classifier that builds directly upon diffusion models. The Diffusion Classifier (Li et al., 2023) is a Zero-Shot image classification method, which uses conditional density estimates of images in pre-trained Diffusion models to construct Zero-Shot image classifiers. In our experiments, we used the same set of candidate labels (39 art genres) to build a diffusion classifier for style classification.

For each generated image, we use both the CLIP classifier and Diffusion classifier to evaluate whether the style mimicking succeeds (whether the victim artist V 's style falls into the top-3 classification results). Typically, all protection methods aim to lower the classifier accuracy as much as possible to prevent style mimicking from happening if the data usage is unauthorized. As can be seen from Table 1, the images generated using clean data samples achieve an average accuracy of 90.8% on the CLIP classifier and 95.4% on the Diffusion classifier. While the generated images using the protected data

Prompt:

A person in an airplane

Prompt:

A person with a red hat

Prompt:

A person in Europe

Prompt:

A person in a restaurant

Protected Image

Purified Image

Clean Image

Protected Image

Purified Image

Clean Image

Task: Style Mimicking

Image Protect Method: GLAZE

samples certainly lower the accuracy to ∼ 42% , after our purified process, the generated images can again achieve an average accuracy of 87.0% and 82.3% on the CLIP classifier and Diffusion classifier respectively, close to the case of clean data samples. By contrast, all the other post-processing baselines only achieved limited improved accuracy, clearly outperformed by our IMPRESS method. We also present some sample results in Figure 4. From Figure 4 (left), we can clearly observe that although the GLAZE method can successfully mislead the LDM when directly used, after using IMPRESS to purify the protected image, we can still exploit the remaining information.

5.3 Experimental Results on Malicious Editing

For the Malicious Editing of Images task, we use a pre-trained LDM to edit images following the guidance of certain prompts. Again we consider input images from clean images, images protected by Photoguard (Salman et al., 2023), and the post-processed images by our method as well as other baselines. We followed the same settings as in the Photoguard paper (Salman et al., 2023), using SSIM (Wang et al., 2004), PSNR, and VIF-p (Sheikh and Bovik, 2006) as image similarity algorithms to measure the fidelity of the generated images. We calculate similarity scores between the edited

IMPRESS

Resize

IMPRESS

Image Editing, Prompt: A person in an airplane

Resize

clean images and the edited protected images, as well as the post-processed images. Higher scores indicate results that are closer to the edited clean images.

According to Table 2, our proposed IMPRESS method achieved the best performance on the PSNR and VIF-p metrics, scoring 15.61 and 0.16, respectively, suggesting the edited images are still close to true images. We also obtained a score of 0.49 on the SSIM metric, which is the second-highest score. Note that in malicious editing, even simple image transformation methods can achieve relatively good results on those comparison-based metrics, which has also been pointed out in Salman et al. (2023) and Sandoval-Segura et al. (2023). This phenomenon confirms our point of view: existing image protection technologies are fragile. In Figure 4 (right), we show some real examples that while directing applying PhotoGuard can certainly cause the edited images less realistic, after being purified by our IMPRESS, the malicious editing would still go smoothly with no obvious artifact affecting the image fidelity.

In Figure 5, we also show some comparison with other post-processing baselines on both style mimicking and image editing. We can observe that IMPRESS largely outperforms other baselines for style mimicking while on image editing, all baselines can achieve decent performances in removing the perturbations. This is also consistent with our previous quantitative results, suggesting the imperceptible perturbations on the image editing task is significantly more fragile.

5.4 Adaptive Image Protection with Consistency-based Losses

In this section, we explore whether it is possible to leverage our consistency-based losses for building even better protection methods that could survive our IMPRESS method and successfully prevent unauthorized data usage in diffusion models. Specifically, since we know that keeping x as consistent as possible with D ( E ( x )) is important, we add this regularization term to the optimization function of the existing protection method design. Take GLAZE as an example and we have the following optimization problem:

The coefficient of the added consistency regularization term is denoted as β . A meticulous tuning of the weight of the adaptive loss term has been carried out, as demonstrated in Table 3. We have modulated the weight of the adaptive loss term extensively, allowing it to comprise approximately 10% to 95% of the total loss. Our observations reveal that a minuscule proportion of the adaptive loss term in the entire loss leads the experimental results to mirror those of conventional image protection techniques, whereas an excessive proportion adversely impacts the performance of image protection.

The most pronounced effect of the adaptive protection technology is observable when β = 40 , and we show the experimental results in Table 4 and 5 based on that. However, even under this condition, IMPRESS manages to attain around 80% accuracy by successfully mitigating the adaptive protective noise. Our experiments indicate that the adaptive design does not genuinely offer robust protection, since IMPRESS can still adeptly eliminate the protective noise, allowing the successful execution of style mimicking tasks, it is conjectured that attaining an optimal equilibrium among the three objective terms may pose a significant challenge.

To enhance the balance of competing objectives, we have incorporated the Orthogonal Projected Gradient Descent (O-PGD) approach by Gowal et al. (2020) into our methodology, as delineated

in Table 6 in the pdf. However, it's discernible that the utilization of O-PGD doesn't substantially bolster the efficacy of the adaptive method.

Based on our experimental observations, we hypothesize that the subpar performance of the adaptive method stems primarily from two intertwined complexities:1) The introduced supplementary loss term complicates the optimization of the loss function. For GLAZE method, the loss function of the adaptive method has three components. Optimizing three different loss components is typically challenging, and striking a balance among these components remains an intricate task. 2) The loss term employed for the adaptive method might clash with the inherent loss term of image protection techniques. The purpose of image protection technologies is to induce semantical differences between generated images and original ones. Our image purification approach aims to make the image maintains its semantic properties (consistency after reconstruction), potentially leading to underlying optimization conflicts. These results suggest that designing adaptive image protection techniques specifically for IMPRESS might inherently be challenging.

6 Conclusion

In this work, proposed IMPRESS, a unified platform to evaluate the effectiveness of imperceptible perturbations as a protective measure. We demonstrated that it is difficult for the current imperceptible perturbations-based protection methods to prevent certain images from being correctly learned or processed by diffusion models as those imperceptible perturbations could be potentially removed with consistency-based losses. The proposed IMPRESS platform offers a comprehensive evaluation on several contemporary protection methods and can be used as an evaluation platform for future protection methods.

References

Omri Avrahami, Ohad Fried, and Dani Lischinski. 2022. Blended latent diffusion. arXiv preprint arXiv:2206.02779 (2022).

Andrew Brock, Jeff Donahue, and Karen Simonyan. 2019. Large Scale GAN Training for High Fidelity Natural Image Synthesis. In International Conference on Learning Representations (ICLR) .

Aurélie Bugeau and Marcelo Bertalmio. 2009. Combining Texture Synthesis and Diffusion for Image Inpainting.. In VISAPP 2009-Proceedings of the Fourth International Conference on Computer Vision Theory and Applications . 26-33.

Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. 2021. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922 (2021).

Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Ionescu, and Mubarak Shah. 2023. Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence (2023).

Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis. Advances in Neural Information Processing Systems 34 (2021), 8780-8794.

Pranav Dixit. 2023. Meet The Three Artists Behind A Landmark Lawsuit Against AI Art Generators. BuzzFeedNews.

Benj Edwards. 2022. Artists stage mass protest against AI-generated artwork on ArtStation. Ars Technica.

Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. 2021. Robust unlearnable examples: Protecting data privacy against adversarial learning. In International Conference on Learning Representations .

Rohit Gandikota, Joanna Materzynska, Jaden Fiotto-Kaufman, and David Bau. 2023. Erasing Concepts from Diffusion Models. arXiv preprint arXiv:2303.07345 (2023).

Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In neural information processing systems (NeurIPS) .

Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. 2020. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 (2020).

Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems 33 (2020), 6840-6851.

Jonathan Ho, Chitwan Saharia, William Chan, David J Fleet, Mohammad Norouzi, and Tim Salimans. 2022. Cascaded Diffusion Models for High Fidelity Image Generation. J. Mach. Learn. Res. 23, 47 (2022), 1-33.

Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. 2021. Unlearnable Examples: Making Personal Data Unexploitable. In ICLR .

Phillip Isola, Jun-Yan Zhu, Tinghui Zhou, and Alexei A Efros. 2017. Image-to-image translation with conditional adversarial networks. In conference on computer vision and pattern recognition (CVPR) .

Joseph Saveri Law Firm LLP. 2023. Class Action Filed Against Stability AI, Midjourney, and DeviantArt for DMCA Violations, Right of Publicity Violations, Unlawful Competition, Breach of TOS. https://cybernews.com/news/ artists-unite-in-legal-battle-against-ai/ .

Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. 2018. Progressive Growing of GANs for Improved Quality, Stability, and Variation. In International Conference on Learning Representations .

Tero Karras, Samuli Laine, and Timo Aila. 2019. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 4401-4410.

Zhifeng Kong and Wei Ping. 2021. On fast sampling of diffusion probabilistic models. arXiv preprint arXiv:2106.00132 (2021).

Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. 2020. Perceptual adversarial robustness: Defense against unseen threat models. arXiv preprint arXiv:2006.12655 (2020).

Vuong Le, Jonathan Brandt, Zhe Lin, Lubomir Bourdev, and Thomas S Huang. 2012. Interactive facial feature localization. In Computer Vision-ECCV 2012: 12th European Conference on Computer Vision, Florence, Italy, October 7-13, 2012, Proceedings, Part III 12 . Springer, 679-692.

Alexander C. Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. 2023. Your Diffusion Model is Secretly a Zero-Shot Classifier. arXiv:2303.16203 [cs.LG]

Bo Li, Kaitao Xue, Bin Liu, and Yu-Kun Lai. 2022b. VQBB: Image-to-image Translation with Vector Quantized Brownian Bridge. arXiv preprint arXiv:2205.07680 (2022).

Changjiang Li, Li Wang, Shouling Ji, Xuhong Zhang, Zhaohan Xi, Shanqing Guo, and Ting Wang. 2022a. Seeing is living? rethinking the security of facial liveness verification in the deepfake era. In 31st USENIX Security Symposium (USENIX Security 22) . 2673-2690.

Andreas Lugmayr, Martin Danelljan, Andres Romero, Fisher Yu, Radu Timofte, and Luc Van Gool. 2022. Repaint: Inpainting using denoising diffusion probabilistic models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 11461-11471.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR) .

Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun-Yan Zhu, and Stefano Ermon. 2021. Sdedit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Representations .

Mehdi Mirza and Simon Osindero. 2014. Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784 (2014).

Alexander Quinn Nichol and Prafulla Dhariwal. 2021. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning . PMLR, 8162-8171.

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460 (2022).

Pranav Dixit. 2023. Don't Be Fooled By AI-Generated Donald Trump Fakes. https://www.buzzfeednews.com/article/pranavdixit/ beware-ai-generated-donald-trump-fakes-today .

Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning . PMLR, 8748-8763.

Evani Radiya-Dixit, Sanghyun Hong, Nicholas Carlini, and Florian Tramèr. 2021a. Data poisoning won't save you from facial recognition. arXiv preprint arXiv:2106.14851 (2021).

Evani Radiya-Dixit, Sanghyun Hong, Nicholas Carlini, and Florian Tramèr. 2021b. Data Poisoning Won't Save You From Facial Recognition. arXiv.

Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. 2022. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125 (2022).

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022b. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 10684-10695.

Robin Rombach, Andreas Blattmann, and Björn Ommer. 2022a. Text-guided synthesis of artistic images with retrieval-augmented diffusion models. arXiv preprint arXiv:2207.13038 (2022).

Olaf Ronneberger, Philipp Fischer, and Thomas Brox. 2015. U-net: Convolutional networks for biomedical image segmentation. In Medical Image Computing and Computer-Assisted InterventionMICCAI 2015: 18th International Conference, Munich, Germany, October 5-9, 2015, Proceedings, Part III 18 . Springer, 234-241.

Jérôme Rony, Eric Granger, Marco Pedersoli, and Ismail Ben Ayed. 2021. Augmented Lagrangian adversarial attacks. In Proc. of ICCV . 7738-7747.

Chitwan Saharia, William Chan, Huiwen Chang, Chris Lee, Jonathan Ho, Tim Salimans, David Fleet, and Mohammad Norouzi. 2022a. Palette: Image-to-image diffusion models. In ACM SIGGRAPH 2022 Conference Proceedings . 1-10.

Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. 2022b. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems 35 (2022), 36479-36494.

Babak Saleh and Ahmed Elgammal. 2015. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv preprint arXiv:1505.00855 (2015).

Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen. 2016. Improved techniques for training gans. In neural information processing systems (NeurIPS) .

Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry. 2023. Raising the Cost of Malicious AI-Powered Image Editing. arXiv preprint arXiv:2302.06588 (2023).

Robin San-Roman, Eliya Nachmani, and Lior Wolf. 2021. Noise estimation for generative diffusion models. arXiv preprint arXiv:2104.02600 (2021).

Pedro Sandoval-Segura, Jonas Geiping, and Tom Goldstein. 2023. JPEG Compressed Images Can Bypass Protections Against AI Editing. arXiv preprint arXiv:2304.02234 (2023).

Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y Zhao. 2023. GLAZE: Protecting Artists from Style Mimicry by Text-to-Image Models. arXiv preprint arXiv:2302.04222 (2023).

Hamid R Sheikh and Alan C Bovik. 2006. Image information and visual quality. IEEE Transactions on image processing 15, 2 (2006), 430-444.

Jie Shi, Chenfei Wu, Jian Liang, Xiang Liu, and Nan Duan. 2022. Divae: Photorealistic images synthesis with denoising diffusion decoder. arXiv preprint arXiv:2206.00386 (2022).

Jiaming Song, Chenlin Meng, and Stefano Ermon. 2020a. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 (2020).

Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. 2020b. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456 (2020).

Arash Vahdat, Karsten Kreis, and Jan Kautz. 2021. Score-based generative modeling in latent space. Advances in Neural Information Processing Systems 34 (2021), 11287-11302.

Tengfei Wang, Ting Zhang, Bo Zhang, Hao Ouyang, Dong Chen, Qifeng Chen, and Fang Wen. 2022. Pretraining is all you need for image-to-image translation. arXiv preprint arXiv:2205.12952 (2022).

Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing 13, 4 (2004), 600-612.

Julia Wolleb, Robin Sandkühler, Florentin Bieder, and Philippe C Cattin. 2022. The swiss army knife for image-to-image translation: Multi-task diffusion models. arXiv preprint arXiv:2204.02641 (2022).

Han Zhang, Tao Xu, Hongsheng Li, Shaoting Zhang, Xiaogang Wang, Xiaolei Huang, and Dimitris N Metaxas. 2017. Stackgan: Text to photo-realistic image synthesis with stacked generative adversarial networks. In Proceedings of the IEEE international conference on computer vision . 5907-5915.

Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In Computer Vision and Pattern Recognition (CVPR) .

Min Zhao, Fan Bao, Chongxuan Li, and Jun Zhu. 2022. Egsde: Unpaired image-to-image translation via energy-guided stochastic differential equations. arXiv preprint arXiv:2207.06635 (2022).

Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A Efros. 2017. Unpaired image-to-image translation using cycle-consistent adversarial networks. In international conference on computer vision(ICCV) .

A Algorithm of IMPRESS

The following outlines the algorithmic process of our proposed IMPRESS method for the removal of protective noise.

Algorithm 1 IMPRESS

Input: Image encoder E , image decoder D ; hyperparameters α , η , ∆ L . 1: Initialize x pur = x ptb + N ( µ, σ 2 I ) 2: for iter = 1 , 2 , · · · , N do 3: L sim = || x pur -D ( E ( x pur )) || 2 2 4: L lpips = max( LPIPS ( x pur , x ptb ) -∆ L , 0) 5: L = L sim + α L lpips 6: x pur ← x pur -η ∇ x L 7: x pur = Clip ( x pur , min = -1 , max = 1) 8: end for 9: Return x pur

B Detail of Experiment

In this section, we have provided a detailed introduction to our experimental setup. The random seed for all experiments is set to 0, and our experiment code is publicly available in https: //github.com/AAAAAAsuka/Impress .

Style Mimicking Since we do not have access to unreleased artworks, we conduct all the style mimicking experiments on the WikiArt dataset (Saleh and Elgammal, 2015). The WikiArt dataset contains paintings from 195 famous artists throughout history. The dataset consists of 42,129 training images and 10,628 testing images. WikiArt categorizes all artists into 27 different genres (e.g., Impressionism, Cubism). we remove artists from the WikiArt dataset that the CLIP model cannot accurately classify (classification accuracy less than 80%). Then, we select nine artists with the most artworks among the remaining artists, eight of which are used for testing the model's performance, and the remaining artist serves as the validation set for adjusting hyperparameters.

For GLAZE (Shan et al., 2023), we basically follow the original paper's setting: given a victim artist V , we randomly select 124 of their works. Then, we use the ViT+GPT2 model to generate a title for each work and attach the victim artist V 's name to the generated title as the prompt y . Next, we randomly draw 24 works from these 124 art pieces as the style imitation training set, and the remaining 100 as the test set. Afterward, we use the stable-diffusion-2-1-base model released on Hugging Face as the initial pre-trained model weights and fine-tune it on the training set. After obtaining the fine-tuned LDM, we generate imitation works in the style of the victim artist using the prompts from the training set. Finally, we selected 8 artists and randomly extracted 24 pieces for fine-tuning the diffusion model and 100 pieces for validation, totaling 800 evaluation samples.

For fine-tuning the diffusion model, we use the fine-tuning script released with the model, training for 500 steps on the training set with a learning rate of 5 × 10 -6 . For GLAZE, we choose a perturbation budget of p = 0 . 05 , regularization coefficient α = 30 , and train for 500 steps using the Adam optimizer with a learning rate of 10 -2 . For our method, we set the perturbation budget to p = 0 . 1 , regularization coefficient α = 0 . 1 , and train for 3,000 steps using the Adam optimizer with a learning rate of 10 -2 .

Malicious Editing of Images We use the Helen (Le et al., 2012) dataset for the experiments in the Malicious Editing of Images task. Helen is an annotated facial image dataset, consisting of 2,330 images sourced from Flickr. The annotations include facial landmarks and masks of facial features such as eyes, nose, etc. The dataset also includes masks for the entire face.

For malicious editing of images , We utilize the code and settings made public by Photoguard(Salman et al., 2023) for image protection. The purpose of the Malicious Editing of Images task is to modify the background of a photo. Hence, we selected the 80 images with the smallest face-to-image ratio from the Helen dataset and their corresponding face masks (the sample size of Photoguard experiment

is 60). Subsequently, we use Photoguard to generate protective noise for these images. Then, we attempt to modify the images using a diffusion model with the prompt "A person in an airplane".

We generate noise using the most powerful Diffusion attack-L2 method in Photoguard, and all hyperparameters adhere to the settings in the open-source code. We use the runwayml/stablediffusion-inpainting model released on Hugging Face to modify images, with a guidance strength of 7 . 5 and 100 diffusion steps.For our method, we set the perturbation budget to p = 0 . 1 , regularization coefficient α = 10 -2 , and train for 1,000 steps using the Adam optimizer with a learning rate of 5 × 10 -3 .

C More Experimental Results

Prompt: A person in an airplane

Artist: Albrecht Durer

Prompt: A person in a restaurant

Protected Image

Purified Image

Clean Image

Protected Image

Purified Image

Clean Image

Prompt: A person with a red hat

Prompt: A person in Europe

EEROPPNE

Task: Style Mimicking Image, Protect Method: GLAZE

D Ablation Study

0.01

0.05

0.1

0.15

0.2

∆

L

0

.

80

0

.

82

0

.

84

0

.

86

CLIP ACC

∆

L

(a) The Effect of

∆

L

0.01

0.05

0.1

0.15

0.2

α

0

.

76

0

.

78

0

.

80

0

.

82

0

.

84

0

.

86

CLIP ACC

α

(b) The Effect of

α

0.01

0.05

0.1

0.15

0.2

∆

L

14

.

8

14

.

9

15

.

0

15

.

1

15

.

2

15

.

3

15

.

4

15

.

5

15

.

6

PSNR

∆

L

(a) The Effect of

∆

L

0.001

0.005

0.01

0.02

0.05

α

14

.

9

15

.

0

15

.

1

15

.

2

15

.

3

15

.

4

15

.

5

15

.

6

PSNR

α

(b) The Effect of

α

In this section, we analyze the effects of two hyperparameters in our method: α and ∆ L . Among them, α is the balance weight in the entire optimization objective of Impress, and ∆ L is the threshold of the LPIPS regularization term. Here, we use the CLIP evaluation indicator in the Style Mimicking task and the PSNR indicator in the Malicious Editing of Images task to evaluate the impact of hyperparameters. The evaluation results are shown in Figure 7 and Figure 8. For the threshold ∆ L of the LPIPS regularization term, by observing Figure 7(a) and Figure 8(a), we can see that when ∆ L is too large, the LPIPS term loses its constraining effect. This may cause the purification process to make excessive modifications to the original image, thereby destroying the semantic information such as style/content in the original image, resulting in poor performance. When ∆ L is too small, the LPIPS regularization term dominates the optimization process. This causes the purified image to be too similar to the protected image, retaining some protective noise, thereby affecting performance. Similarly, by observing Figure 7(b) and Figure 8(b), we can find: 1) When the balance weight α is too large, it will cause the weight of the LPIPS term to be too large, causing similar results to when ∆ L is too small, that is, retaining too much protective noise, thus leading to a decrease in purification effect. When α is too small, the LPIPS term loses its constraining effect.

At the same time, by comparing Figure 7 and Figure 8, we found that the Photoguard method is more sensitive to hyperparameters. We believe this may be because the disturbance is constrained by L 2 in Photoguard, which leads to some obvious point-like artifacts on the image. These point-like artifacts may play a "trigger" role. When they cannot be effectively removed, the purification effect will decrease.

0

500

1000

1500

2000

2500

3000

Purify iterations

4

.

0

4

.

5

5

.

0

5

.

5

6

.

0

6

.

5

7

.

0

7

.

5

L

2

distance between

zpur

and

z

Albrecht Durer

E A Metric-based validity study

To validate the effectiveness of our method, we calculated the distance of the embedding z pur of the purified image in the diffusion model relative to the embedding z of the clean image in the Style Mimicking task during the purification process. Please note that in the entire purification process of IMPRESS, we cannot get the clean image, that is, we do not know z .

We plotted the results in Figure 9. For a protected image, we recorded the embedding z pur after each step in the purification process using IMPRESS, totaling 3000 steps (consistent with our experimental setup). Then we normalize z and all z pur, and then calculate the L 2 distance between z pur after each step and z , thereby obtaining the L 2 distance between z pur after each step and z during the purification process of this image. Finally, we average the results obtained from all pictures selected from each artist. We plotted the average value of each artist in Figure 9 as a separate curve.

As can be seen, for all artists, the L 2 distance between z pur after each step in the purification process and z gradually decreases. This means that the feature vector of the purified image in the model is more similar to the clean image, which also means that our method effectively removes the protective noise and is effective for all kinds of different types of artworks.

F Real-World Style Mimicking Service

We tested our method on a real-world image generation service website. scenario.com is a image generation service provider that allows users to upload a set of images and mimic the style of these images, and then generate images with similar styles based on the prompts provided by the user. We randomly selected the works of 4 artists in our experiment as the targets for imitation, then used scenario.com to mimic clean images, images protected by GLAZE, and images purified by IMPRESS respectively, and generated two sets of new images for each. The training data used in the imitation process is consistent with the data used in the default parameter settings in our experiment, and the test results are shown in Figure 10. As can be seen, GLAZE effectively protects the images on real-world services. The style of the image protected by GLAZE is completely different from the original image, and the content of the picture is severely damaged, sometimes it is difficult to identify the content of the image. On the other hand, new images generated by imitating IMPRESS purified images are highly consistent in style and content with those generated by imitating clean images, which implies that our method can effectively remove protective noise.

Artist: Albrecht Durer

Protected Image

Purified Image

Clean Image

a woman in a pink dress

holding flowers

a building with a clock

a woman sitting on a bench

a boat in the water

a man in a suit

a table topped with bowls of

fruit and vegetables

a group of people in a field

a man holding a knife

in his right hand

Source:

Protected Image

Purified Image

Clean Image

Source:

Protected Image

Purified Image

Clean Image

Source:

Protected Image

Purified Image

Clean Image

Source:

G Impact of IMPRESS on Clean Images

After testing, our method does not affect clean data. We conducted an experiment where IMPRESS was directly applied to clean images. For the Style Mimicking task, the ACC of the CLIP Classifier was 91.2%, and the ACC of the Diffusion Classifier was 92.5%, both of which were close to the results obtained from fine-tuning the model directly using clean data. For the Malicious Editing of Images task, SSIM, PSNR, and VIF-p were respectively 0.59, 16.70, and 0.23, significantly higher than other experiments. Figure 11 shows the images obtained by using IMPRESS to purify clean images and the results of using clean images directly in the two tasks, showing that our method hardly impacts clean images.

H Explanation of Differences in GLAZE Experimental Results

In the original GLAZE paper, the selection method of the target style T is to randomly choose a style that is significantly different from the victim artist V , but the paper does not provide specific style selection data and hyperparameter settings. We attempted to reproduce the target style selection method proposed in the original GLAZE paper as much as possible and conducted multiple random experiments. Using the same data and default hyperparameters, the average accuracy of the image generated by the Protected image as training data in the CLIP classifier is 59.8% when using the target style selection method of GLAZE, while the average result after purification by IMPRESS is 87.9%. We found that the GLAZE method is very sensitive to the target style T . For a particular artist, a reasonable target style can make the average accuracy of the GLAZE method in the CLIP classifier less than 10%.

To ensure the consistency and reproducibility of the experiment, we choose to use "Cubism by Picasso" as the target style in our tests, because "Cubism by Picasso" is one of the target style prompts used by GLAZE in the example results shown in the paper, and a clear protective effect can be seen. With the target style unified, "Cubism by Picasso" is also the best performing target style. The specific results for each artist are shown in Table 7.

Style Mimicking

Image Editing

Clean Image

Purified Clean Image

Clean Image

Source:

Sample1:

Sample2:

Task:

Purified Clean Image

I Comparison with More Baseline Methods

In this section, we compare our proposed IMPRESS with four additional baseline methods: 1) traditional denoising method (e.g., low-pass filtering); 2) enhanced preprocessing approaches (re-

size+flipping+JPEG compression); 3) robust training methods (e.g., Radiya-Dixit et al. (2021a)); 4) advanced denoising approaches (e.g., Diffpure (Nie et al., 2022))

Table 8 and 9 show the experimental results for those additional baselines. For the Style Mimicking task, we have incorporated additional baselines, namely low-pass filtering, resize + flipping + JPEG compression, and the robust training method by Radiya-Dixit et al. (2021a). For the Malicious Editing task, we have added low-pass filtering, resize + flipping + JPEG compression, and Diffpure (Nie et al., 2022) as baselines. It can be observed that our approach still achieved the best results comparing with those additional baselines. Note that robust training method (Radiya-Dixit et al., 2021a) is not tested on malicious editing task since it does not involve model fine-tuning. And Diffpure (Nie et al., 2022) is not tested on style mimicking task since it requires a pre-trained non-latent diffusion model on the target distribution (which is one of the major limitation of this method) but it is hard to find one on artist data currently.

J Computational Complexities

The extra computations needed for our method is also not very significant. Under our experimental setup, the purification of a single image took an average of 141 seconds. In comparison, GLAZE took an average of 90 seconds to compute adversarial noise for an image, while Photoguard required more than 600 seconds on average to perform the computations. In fact, due to the large size of the stable diffusion model, fine-tuning the model actually takes much longer time than optimizing those images, thus we believe the computational cost will Acceptable.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the reliability of methods for imperceptibly perturbing images to degrade the performance of latent diffusion models for style mimicry or editing. The authors observe that imperceptible perturbations designed to hamper diffusion-based image generation systems often result in perceptible artifacts when the “protected” image is reconstructed with a diffusion model. Noting that unprotected images typically do not exhibit such behavior, the authors propose a “purification” method in which images are optimized with respect to both a consistency objective (such that diffusion reconstruction preserves the purified image) and a similarity objective (such that purification does not perceptibly alter the image). The proposed purification method effectively mitigates two recent imperceptible perturbation methods for image editing and style transfer, indicating that stronger techniques are needed to protect image data from unwanted diffusion-based manipulation.\n\nSTRENGTHS:\nThe issue of protecting intellectual property such as images from unauthorized use by the operators of generative models is timely and significant.\n\nThe proposed purification approach — essentially an image adversarial attack using a simple encoder-decoder consistency objective, projected gradient descent, and Gaussian perturbation initialization — appears straightforward to implement, and is effective in both fine-tuned style mimicry and one-shot image editing scenarios.\n\nThe authors evaluate their purification method against adaptive perturbations optimized with knowledge of the purification objective and find their method still remains effective\n\nThe authors include reasonable protection methods (GLAZE, Photoguard) and purification baselines (JPEG compression, Gaussian noise, resizing) in their experiments.\n\nWEAKNESSES:\nFigures 1 and 4 are unnecessarily hard to read. For the style mimicking experiments, the labels for each column (\"clean image\", \"protected image\", \"purified image\") misleadingly indicate that the images below are actual clean/protected/purified images from the dataset when in fact they appear to be images generated by a model fine-tuned on either clean, protected, or purified images. For the editing experiment, it would be better to actually show the input clean/protected/purified image in addition to the edited versions. This might require a tweak to the figure format or perhaps separate figures, but I think that more legible figures would better communicate the authors' proposed approach.\n\nTo justify the choice of tasks on which the proposed method is evaluated, the authors should more clearly indicate that they evaluate against two recent imperceptible protection methods on the specific tasks for which these protections methods were proposed. Otherwise, the choice of task (e.g. background editing) could come off as arbitrary.\n\nThe size of the experiment datasets are not stated (e.g. for style mimicry, the number of images per artist is given, but not the number of artists). The total number of samples evaluated should be given for both experiments.\n\nAdaptive protection results are shown only for style mimicry, not editing.\n\nThe authors do not appear to discuss the runtime / computational complexity of their purification method. \n\nIn apparent contradiction with the authors' response to the NeurIPS checklist, compute details appear to be missing from the paper and appendix.\n\nFor the experiments section, the image examples are currently more compelling than the metrics. For the image editing task, it is not clear from Table 2 how much \"better\" the purified images fare than protected images -- e.g., how significant is a PSNR value of 15 vs. 14? Is there a value below which an attempted edit can be considered a failure? Without context, it is hard to get a sense of the effectiveness of the proposed approach. The classifier metrics for the style mimicry experiment are clearer, but still do not take into account many aspects of generated image quality (e.g. adherence to the prompt beyond style). A human subjects study assessing the quality and \"correctness\" of images generated in each task for the clean/protected/purified conditions would be much more persuasive.\n\nThe evaluation tasks appear to involve image models that operate under different \"control\" paradigms -- fine-tuning and text-prompting in the case of style mimicry, and one-shot image-conditioning and text-prompting in the case of background editing. This difference seems significant in that in the former case, purification must mitigate the influence of protective perturbations on the training process while in the latter case, purification must only mitigate the influence of protective perturbations on a forward pass through the diffusion model. I think this distinction between experimental tasks should be emphasized because (a) it is not immediately clear in the paper, and (b) because it is possible this could be framed as a strength of the proposed method (i.e. operating in distinct tasks/settings).\n\nQUESTIONS:\nIt is interesting that the simple consistency objective is sufficient to defeat protective perturbations, especially when optimized only with knowledge of the image encoder and decoder. Does this result imply that existing protection approaches primarily leverage the image encoder and decoder rather than the latent diffusion model itself? It would also be interesting to see whether there are other efficient ways to approximately optimize through the latent diffusion process.\n\n(The following is more of a thought / comment than a question). In the adversarial example literature, methods have been proposed to tackle optimization with respect to competing objectives (e.g. perturbation effectiveness and imperceptibility). Often, one objective dominates the optimization even when loss values are scaled with well-chosen weights, leading to poor results and inaccurate estimates of robustness. The method of Bryniarski et al. [1] seems to be effective in allowing adaptive adversaries to better balance multiple constraints. Such an approach might lead to more effective balancing of the similarity and consistency objectives not just for the IMPRESS purification method, but for an adaptive adversary like the one proposed in section 5.4 of the paper. I think the simple projected gradient descent method and loss formulation the authors propose in this paper is fine -- it shows the effectiveness of the core idea without the need for extensive tweaks -- but it would also be interesting to see future work incorporate more recent techniques from adversarial machine learning into the protection and purification methods.\n\n[1] Bryniarski, Oliver and Hingun, Nabeel and Pachuca, Pedro and Wang, Vincent and Carlini, Nicholas. \"Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent.\" ICLR 2022.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes IMPRESS, a new purification method to remove imperceptible perturbations that are claimed to be able to prevent unauthorized data usage in diffusion-based image generation. Specifically, IMPRESS aims to produce a purified version of the perturbed image by minimizing the distance between the perturbed image and its reconstructed image as well as the distance between the perturbed image and the purified image. The authors also consider a challenging scenario where protection can be adapted to IMPRESS.\n\nSTRENGTHS:\n- Very good writing and thorough review of related work\n- Clear motivation, especially for the elegant design of the consistency loss\n- Sufficient descriptions of technical details of IMPRESS and the experimental settings\n- Two SOTA protection methods in two tasks are considered.\n\nWEAKNESSES:\n- Limited comparison to (potential) baselines. \n1) First of all, as acknowledged by the authors in Section 5.3, previous work (Salman et al. and Sandoval-Segura et al., 2023) has already identified the effectiveness of JPEG compression in solving the studied problem. Therefore, it should be explicitly stated in the Introduction that this paper is not the first to study whether “Imperceptible Perturbations Really Prevent Unauthorized Data Usage”. One specific question: What does it mean by “compression rate as 15%”? Is the quality factor 15% (stronger compression) or 85%? This is important because Sandoval-Segura et al. 2023 have found that choosing strong compression is the key to purifying the perturbations.\n2) In addition, the countermeasures that are considered in the original papers of GLAZE and PhotoGuard should also be compared. This is necessary because this paper considers two different metrics (i.e., style classification scores) for measuring the effectiveness of IMPRESS. It is not clear whether those originally considered countermeasures can already achieve very good results in these two metrics.\n3) Other popular purification methods should also be tested. For example, existing work has shown that diffusion-based purifications are very effective in removing adversarial perturbations. Such methods should be definitely compared.\n\n- Limited explorations of adaptive attacks. Table 3 demonstrates that adaptive attacks show similar results and even worse results than non-adaptive attacks. This is surprising since additional knowledge is incorporated, and it also gives a sign that the adaptive attack may not be properly designed. The authors should either consider better designs or explain why this weird phenomenon happens.\n\nTypos:\n\nLine 232: should be some grammatical mistake for “setting reproduced the code”\n\nLine 309: whether is possible -> whether it is possible\n\nQUESTIONS:\nSee weaknesses\n\nLIMITATIONS:\nI do not find anywhere discussing Broader Impacts and Limitations, although the authors check \"yes\".", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-08"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work is focused on testing the vulnerability of approaches that prevent unauthorized data usage in diffusion models. The paper shows that existing approaches for this problem are fragile, and leads to difference b/w original and diffusion reconstructed image. Then, based on the previous observation the paper proposes a method named IMPRESS to purify the modified images based on a consistency loss. The results show that the proposed approach can successfully purify the imperceptible modifications on two existing approaches, GLAZE and PhotoGuard. Lastly, the work shows that an adaptive variant of GLAZE, that takes into account the proposed consistency loss still can't defend against IMPRESS.\n\nSTRENGTHS:\n1. The writing quality of the paper is satisfactory. The main approach is easy to follow, and important preliminaries are clearly explained.\n2. The results show that the proposed approach can surpass simple baselines. Both PhotoGuard, and GLAZE function as a form of adversarial attack, and thus should be vulnerable to similar transformations such as JPEG Compression, and geometric transformations. The work considers these as baselines and shows for GLAZE the proposed approach works better. For PhotoGuard, all baselines perform equivalently and are able to purify the protected image.\n\nWEAKNESSES:\n1. The overall contribution of this work may not be significant. The work relies on solving an expensive optimization problem and shows that imperceptible perturbation cannot prevent unauthorized data usage. However, it also shows that simple preprocessing approaches such as JPEG, and Resizing are effective against PhotoGuard. A similar observation was already made by [1]. The results on GLAZE show better performance, but the work doesn't consider more optimized baselines such as what happens for different JPEG compression ratios, or JPEG + Resizing + other geometric transforms. \n\n2. The computational complexity of recovering the purified image is not discussed, especially w.r.t baselines.  How long does the proposed approach take? JPEG and Resizing are fairly inexpensive operations compared to the proposed approach that relies on solving an optimization problem.\n\n[1] Sandoval-Segura, Pedro, Jonas Geiping, and Tom Goldstein. \"JPEG Compressed Images Can Bypass Protections Against AI Editing.\" _arXiv preprint arXiv:2304.02234_ (2023).\n\nQUESTIONS:\n1. The approximation of consistency loss from the diffusion model to the encoder-decoder is unintuitive. Does this imply the IMPRESS approach is independent of the diffusion model? \n2. Related to the above, how would the IMPRESS approach work for a non-latent diffusion model?\n\nLIMITATIONS:\nSee the weaknesses above.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-09"}

comments: SUMMARY:
In this work, the authors showed some intellectual protection methods for diffusion methods via imperceptible perturbations could be removed, hence questing the effectiveness of such methods. The authors observed perceptible inconsistency between the pair of original samples and the reconstructed ones by diffusion models, and then proposed IMPRESS method to disable these imperceptible perturbations. In the experiments, the authors tried to break two image protection methods, namely GLAZE and Photoguard, and showed their advantage over some known post-processing methods.

STRENGTHS:
1). This work studies an interesting problem that questions the real effectiveness of the existing image protection methods.
2). The empirical observation between the differences of protected images and reconstructed images seem appealing.
3). The paper presents well and is easy to follow.

WEAKNESSES:
1). The two terms in the proposed loss (in Eq.4.1) are common denoising operators and are straightforward to come up with. This may hinder the technical novelty of this work.
2). There have been many denoising methods in the computer vision community, either deep learning based or conventional methods. Could these methods be modified as a proxy of the proposed method? 
3). This paper lacks baseline methods. Why not compare with advanced denoising methods? 
4). Though the methods to break are based on imperceptible perturbations, there can also be perceptible ones, please discuss whether your method can deal with such perturbations.

QUESTIONS:
See Weakness.

LIMITATIONS:
NA.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-10

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nDiffusion-based image generation models, such as Stable Diffusion or DALLE2, are able to learn from given images and generate high-quality samples following the guidance from prompts. However, such ability also brings unauthorized data usage problem. In response, several attempts have been made to protect the original images from this problem by adding imperceptible perturbations. The author discovered that it is possible to render these methods ineffective by purifying the image and disabling the added perturbation. They conduct experiments for style mimicking and malicious editing tasks to comprehensively evaluate the risks of using imperceptible perturbations.\n\nSTRENGTHS:\n1.\tThis paper identifies a common drawback in existing data protection methods by adding imperceptive perturbations. \n2.\tThe method proposed by the authors is straightforward in its implementation but yields impressive results.\n\nWEAKNESSES:\n1.\tThe method proposed in this article is based on empirical findings and lacks profound theoretical support, which is slightly incongruent with the theme of the NeurIPS conference.\n2.\tThis work has limited novelty because this approach is commonly used in the detection and removal of adversarial examples.\n3.\tThe experimental results exhibited in the article have limited scope and quantity, which makes it difficult to provide strong support for the effectiveness of the method.\n\nQUESTIONS:\n1.\tWhy the adaptive image protection with consistency-based losses in section 5.4 does not really bring true protection? What is the underlying reason behind it?\n2.\tHow effective is the proposed method attacking against other methods which protect the original images from style mimicking or malicious editing?\n3.\tHow do you solve the optimization problem in Eq.(4.1)? Is it through deep learning methods or mathematical methods, please provide some more details about the algorithm.\n\n---------------------------------\nI read the rebuttal and the questions are answered. My main concern is the novelty of the methodology.\n\nLIMITATIONS:\nIt is recommended that the authors explain the limitations of the proposed method, such as potential negative social impact (i.e., someone may do malicious editing of images by using your approach),  limited applicable scenarios and so on.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-12"}