Title: BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
Venue: NeurIPS 2025
Accepted: yes
Keywords: copyright protection

adversarial examples

text-to-image models

computer vision
Abstract: Recent advances in text-to-image models have increased the exposure of powerful image editing techniques as a tool, raising concerns about their potential for malicious use. An emerging line of research to address such threats focuses on implanting “protective” adversarial noise into images before their public release, so future attempts to edit them using text-to-image models can be impeded. However, subsequent works have shown that these adversarial noises are often easily “reversed,” e.g., with techniques as simple as JPEG compression, casting doubt on the practicality of the approach. In this paper, we argue that adversarial noise for image protection should not only be imperceptible, as has been a primary focus of prior work, but also irreversible, viz., it should be difficult to detect as noise provided that the original image is hidden. We propose a surprisingly simple method to enhance the robustness of image protection methods against noise reversal techniques. Specifically, it applies an adaptive per-region Gaussian blur on the noise to adjust the overall frequency spectrum. Through extensive experiments, we show that our method consistently improves the per-sample worst-case protection performance of existing methods against a wide range of reversal techniques on diverse image editing scenarios, while also reducing quality degradation due to noise in terms of perceptual metrics. Code is available at https://github.com/jsu-kim/BlurGuard.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a simple but effective method to enhance the robustness of image protection methods against noise reversal techniques, employing an adaptive Gaussian blur on the noise to adjust the overall frequency spectrum. Unlike previous efforts primarily focused on imperceptibility, this approach emphasizes the irreversibility of adversarial noise, making it difficult to detect as noise.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**:\n1. The paper offers a novel perspective by focusing on \"irreversibility\" rather than solely \"imperceptibility\" for image protection. And the proposed approach is surprisingly simple but effective.\n2. The method's effectiveness is thoroughly demonstrated through comprehensive experiments across various AI-generated scenarios and diverse noise purification techniques.\n\n**Weakness**:\n1. The ablation study indicates that \"Per-region adaptation\" might contribute less significantly compared to other modules. It would be beneficial to qualitatively show the different blur intensities across different regions for specific cases. Additionally, since the blur intensity depends on the semantic regions, a statistical correlation between specific semantic categories and their corresponding blur intensities may reveal interesting insights into how this module functions.\n2. Most inpainting methods mask edited regions during processing. A concern arises if the masked area is a region with strong adversarial noise; it's unclear if the proposed method would remain effective. The inpainting experiments (line 278) in this paper are limited to facial images and focus only on modifying areas around the face. However, real-world inpainting scenarios are far more diverse, with unpredictable manipulation regions. This limited experiment might not fully cover all types of inpainting tasks.\n3. More comprehensive details are needed for the ImageNet-Edit dataset. This includes clearer information about the prompts used and a statistic of image categories.\n\nQUESTIONS:\n*Please refer to the weaknesses mentioned above.*\n\n1. The ablation study indicates that \"Per-region adaptation\" might contribute less significantly compared to other modules. It would be beneficial to qualitatively show the different blur intensities across different regions for specific cases. Additionally, since the blur intensity depends on the semantic regions, a statistical correlation between specific semantic categories and their corresponding blur intensities may reveal interesting insights into how this module functions.\n2. Most inpainting methods mask edited regions during processing. A concern arises if the masked area is a region with strong adversarial noise; it's unclear if the proposed method would remain effective. The inpainting experiments (line 278) in this paper are limited to facial images and focus only on modifying areas around the face. However, real-world inpainting scenarios are far more diverse, with unpredictable manipulation regions. This limited experiment might not fully cover all types of inpainting tasks.\n3. More comprehensive details are needed for the ImageNet-Edit dataset. This includes clearer information about the prompts used and a statistic of image categories.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper tackles the problem that existing adversarial image-protection schemes are easily neutralised by simple post-processing such as JPEG compression or diffusion-based “purification”. The authors observe that many prior perturbations concentrate energy in high-frequency bands and are therefore easy to detect and strip away in the frequency domain. BlurGuard addresses this with two ingredients: (1) Per-region adaptive Gaussian blurring: using SAM masks, different σ values are learned for each semantic region so the perturbation’s spectrum better follows the underlying content. (2) Power-spectrum regularisation: an ℓ∞ penalty on the log-ratio between the RAPSD of the original and protected images keeps the overall spectrum “natural”.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n1. Re-framing protection as spectral naturalness instead of pure imperceptibility is simple yet insightful.\n2. The paper is well written with clear figures.\n\n## Weaknesses\n1. The testing primarily relies on outdated UNet-based diffusion models. Experiments on modern models with MMDIT architecture and flow-matching training paradigms, such as SD3.5 [1], FLUX.Fill [2], or Step1X-Edit [3], would strengthen the evaluation.\n\n2. The authors should consider including a section on additional related work, as some studies, such as VINE [4] and Robust-Wide [5], focus on enhancing image watermark robustness to protect images against editing. These works are relevant to the authors’ research, particularly those analyzing image editing from a frequency perspective.\n\n3. The transferability analysis lacks persuasiveness, as SD 1.4 shares the same architecture and some training data with SD 2.1. Demonstrating that image protections optimized for SD-v1.4 are effective against models like FLUX.Fill [2] or Step1X-Edit [3] would provide more robust evidence of transferability.\n\n[1] [SD3.5](https://huggingface.co/stabilityai/stable-diffusion-3.5-large)\n\n[2] [Flux.Fill](https://huggingface.co/black-forest-labs/FLUX.1-Fill-dev)\n\n[3] [Step1X-Edit](https://github.com/stepfun-ai/Step1X-Edit)\n\n[4] [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://arxiv.org/abs/2410.18775)\n\n[5] [Robust-Wide: Robust Watermarking against Instruction-driven Image Editing](https://arxiv.org/abs/2402.12688)\n\nQUESTIONS:\nPlease review the Weaknesses section. If all of my concerns are fully resolved, I’ll gladly raise my rating; if the assessment is still lacking, I may lower it instead.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper asserts that existing data poisons for diffusion models are weak to purification-based defenses because they fail to conform to the data prior expected by the diffusion models. They propose that this nonconformity can be identified as a deviation from real (unpoisoned) images in the frequency spectrum, as measured by RAPSD curves. They propose an adaptive per-region blurring operation applied to adversarial noise in order to encourage the adversarial images to align closer to real images. They present experiments, comparing BlurGuard to multiple current poisons and validating their method across multiple defenses. They measure the naturalness (i.e., imperceptibility) and effectiveness (i.e., worst-case performance decrease after purification) of adversarial images.\n\nSTRENGTHS AND WEAKNESSES:\n- Significance: Protection for personal data or copyright against copying or theft is an important topic. Moreover, existing protections for images are easily circumvented by purification-based (or other) defenses. Research into effective data poisons is necessary if artists and copyright holders are to continue publishing their work in a public setting.\n- Originality: BlurGuard has moderate originality. Most poisons in diffusion literature utilize an adversarial component and a perceptibility constraint (e.g., LPIPS in Glaze/Nightshade or a simple norm-ball on adversarial signal). Prior works on poisoning in other domains have explored blurring and sharpening filters as poisons (e.g., https://arxiv.org/abs/2303.04278, https://link.springer.com/chapter/10.1007/978-3-031-73464-9_5). In the diffusion domain, Gaussian blur has been used to model transitions between probability distributions (i.e., heat dissipation vs diffusion) (e.g., https://arxiv.org/pdf/2206.13397). Papers in that area have also utilized spectral density plots for analysis. Regardless, I have not seen these specific components combined for the purpose of poisoning. I think that more exploration into poisons that focus on the frequency-spectrum analysis is necessary, and so BlurGuard is a step in the right direction. The existing ablations in the paper and Appendix G are insightful and valuable. It would be even better if the paper could conduct further ablations to serve as a foundation for further research. Some that come to mind include testing other adversarial objectives instead of just EncoderAttack, analyzing sharpening in addition to blur, and applying blur to the adversarial image (x + delta) instead of just the adversarial noise.\n- Clarity: Clarity is a particular weakness of this paper. My main complaint is the organization of sections 3 and 4. Equation 1 has a notational error, as the argmin of L_enc is equal to the MSE objective, but its argmin is not. Equation 4 is introduced and then never used. I think \"Per-Region Adaptation\" should be introduced before \"Learnable Gaussian Blurring\" in section 4.2 since masking and blurring are strongly linked in BlurGuard. Notation for distance constraints seems inconsistent, using d(-,-), ball B, or ||-||. Also it seems epsilon and eta are used interchangeably. Perhaps a simplified (shorter) Algorithm 1 should be shown in the main paper because the multi-stage optimization procedure is unintuitive, especially with using dummy deltas during stage 1. Elsewhere, some figures have near-unreadable labels (e.g., Fig. 2, Fig. 4). Fig. 4 and its discussion are confusing: I don't understand what is meant by the \"Worst-Case Gap\", does the low value of BlurGuard's \"Worst-case Gap\" indicate that it performs strongly even with a 1/255 adversarial perturbation? \n- Quality: The paper is generally well-written, with straightforward introduction and experiments sections, as well as a nicely organized Appendix. I cite the extensive studies in the appendix as a strength. The authors have also benchmarked performance against a large set of modern adversarial methods and purification methods.\n\nQUESTIONS:\nI have given multiple suggestions in Strengths and Weaknesses. In particular, I emphasize additional ablation studies and improved clarity in section 4. I think these improvements are necessary to accept the paper.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 1, "IMPACT": 4, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nBlurGuard is a effective image protection method designed to improve robustness against AI-driven image editing. It addresses the vulnerability that prior adversarial noise-based protections can be easily reversed by simple post-processing. BlurGuard’s approach is to apply an adaptive local Gaussian blur to the embedded perturbation to adjust its frequency spectrum, making the protective noise difficult to extract while mitigating image quality loss. Experiments show that this method significantly improves worst-case protection performance under diverse image editing scenarios and noise-removal attacks, and achieves superior image quality compared to existing methods.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths：\n1. Innovativeness of the Work.This study demonstrates a notable degree of innovation. The proposed BlurGuard method adjusts the frequency bandwidth of adversarial noise via adaptive Gaussian blurring, presenting a simple yet effective strategy to enhance the robustness of adversarial image protection. Compared to existing approaches, this method emphasizes alignment with the natural frequency spectrum of images, thereby improving the perceptual naturalness of the protected outputs.\n2. Comprehensiveness of the Experimental Evaluation. The experimental section of the paper is well-developed and comprehensive. It provides strong empirical evidence supporting the effectiveness and robustness of BlurGuard. The experiments are rigorously designed and the results are presented in detail, highlighting the advantages of the method under various attack scenarios.\n3. Construction of a Dataset. The study acknowledges the lack of publicly available standardized datasets for malicious image editing and accordingly constructs a tailored evaluation dataset. This dataset encompasses a diverse set of images and editing intentions, facilitating consistent and meaningful comparisons across different protection methods.\n4. Clarity and Logical Organization of the Paper. The paper is clearly written and logically organized. The arguments are well-structured and coherent, enabling readers to follow the motivation, methodology, and contributions of the work in a systematic and persuasive manner.\nWeakness：\n1. Lack of Comparison with the Recent Methods.The comparative methods used in the experimental section are primarily from 2023 and do not include the most up-to-date techniques. For example, more recent approaches such as Distraction is All You Need and EditShield could be incorporated to provide a more comprehensive evaluation.\n2. Insufficient Explanation in Certain Experimental Results.Some parts of the experimental analysis lack detailed interpretation. For instance, in Table 9, the BlurGuard method exhibits relatively lower performance in terms of PSNR under the \"Naturalness\" metric, yet no corresponding explanation is provided in the text.\n3. Lack of Discussion on Alternative Tampering Methods.BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.\n4. Omission of Acronym Explanations.Certain acronyms are not clearly defined in the main text. For example, the “I.A.” metric in Table 1 is not explicitly explained in the body of the paper. Although it is addressed in the appendix, its meaning should be clarified in the main text or table caption to avoid confusion, especially for first-time readers.\n\nQUESTIONS:\n1. Lack of Comparison with the Most Recent Methods. The comparative methods used in the experimental section are primarily from 2023 and do not include the most up-to-date techniques. For example, more recent approaches such as Distraction is All You Need and EditShield could be incorporated to provide a more comprehensive evaluation.\n2. Insufficient Explanation in Certain Experimental Results. Some parts of the experimental analysis lack detailed interpretation. For instance, in Table 9, the BlurGuard method exhibits relatively lower performance in terms of PSNR under the \"Naturalness\" metric, yet no corresponding explanation is provided in the text.\n3. Lack of Discussion on Alternative Tampering Methods. BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.\n4. Omission of Acronym Explanations. Certain acronyms are not clearly defined in the main text. For example, the “I.A.” metric in Table 1 is not explicitly explained in the body of the paper. Although it is addressed in the appendix, its meaning should be clarified in the main text or table caption to avoid confusion, especially for first-time readers.\n\nLIMITATIONS:\nLack of Discussion on Alternative Tampering Methods. BlurGuard is based on adversarial perturbation. If an attacker employs alternative editing techniques, such as methods beyond diffusion models, the protective effectiveness of BlurGuard may be limited. This potential limitation is practically relevant and deserves further discussion.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}