Disrupting Diffusion: Token-Level Attention Erasure Attack against Diffusion-based Customization

Authors: jinyang  an
wanqian  zhang
dayan  wu
jingzi  gu
zheng  lin
weiping  wang
yisu  liu
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-12 16:34:26

Abstract: With the development of diffusion-based customization methods like DreamBooth, individuals now have access to train the models that can generate their personalized images. Despite the convenience, malicious users have misused these techniques to create fake images, thereby triggering a privacy security crisis. In light of this, proactive adversarial attacks are proposed to protect users against customization. The adversarial examples are trained to distort the customization model's outputs and thus block the misuse.
In this paper, we propose DisDiff (Disrupting Diffusion), a novel adversarial attack method to disrupt the diffusion model outputs. 
We first delve into the intrinsic image-text relationships, well-known as cross-attention, and empirically find that the subject-identifier token plays an important role in guiding image generation. Thus, we propose the Cross-Attention Erasure module to explicitly "erase" the indicated attention maps and disrupt the text guidance. Besides, we analyze the influence of the sampling process of the diffusion model on Projected Gradient Descent (PGD) attack and introduce a novel Merit Sampling Scheduler to adaptively modulate the perturbation updating amplitude in a step-aware manner. Our DisDiff outperforms the state-of-the-art methods by 12.75% of FDFR scores and 7.25% of ISM scores across two facial benchmarks and two commonly used prompts on average.

Main paper: 
 introduction: 
 In the era of pre-trained generative AI, individuals wield the power of creating multi-media contents that appears genuinely authentic with just a single click. Despite the success of GAN-and VAE-based image synthesis methods [19, 25, 29, 33, 41, 49] , more impressive and controllable results are achieved by recently proposed diffusion models, such as DALL-E [32] , Imagen [38] and Stable Diffusion [40] . generate almost any style of image by a simple corresponding text instruction, and show the unprecedented capacity for producing high-quality images across various applications.With the users' desire for image synthesis of their subjects, e.g., daily supplies, pets or family members, customized image generation steps onto the stage, with representatives like Textual Inversion [11] and DreamBooth [37] . Leveraging the pre-trained text-to-image diffusion models, Textual Inversion learns a pseudoword in the well-editable word embedding space of text encoder, i.e., 𝑆 * , to represent the newly provided concept. DreamBooth finetunes the diffusion models with a small set of subject images and a subject-identifier token (e.g., sks) included prompt, such as "a photo of sks dog". Iteratively training large amounts of model parameters, DreamBooth achieves superior performance compared to Textual Inversion. More recently, Custom Diffusion [21] fine-tunes the selected parameters in the attention layers to reduce the memory overhead, achieving efficient customization.Despite the convenient editing of users' specified subjects, these methods present a dual-edged dilemma. Malicious users exploit this customization to fabricate synthetic images or videos and spread them on the internet. The generated fake products [6, 20, 51] engender potential security and privacy vulnerabilities for individuals. In response to defend against this, both passive and proactive protections have been proposed for safeguarding privacy. Passive protections, commonly known as DeepFake detection [12, 18, 24, 46, 53, 54] , are employed to determine the authenticity of images. The detecting models are trained to discriminate whether the images are real or fake. However, fake images have been spread before detected and these methods often struggle with novel synthetic techniques [45] . Regarding this matter, proactive protections are proposed with adversarial attacks to disrupt the fake image synthesis [48, 50] . These applications distort the fake image generation with noticeable artifacts, thereby providing cues for detection.As diffusion-based customization methods emerge, the urgency of protecting users' privacy against these techniques becomes paramount. As one of the pioneering works, Anti-DreamBooth [42] aims to disrupt the generation of images produced by DreamBooth. Specifically, Anti-DreamBooth tries to alternatively learn a surrogate diffusion model (or utilize a fine-tuned fixed one) and the adversarial perturbations to improve the attack performances. Despite the destruction of the visual quality of generated images by Anti-DreamBooth, the face still exists. This is obvious not only for human observers (visually) but also for detection algorithms (quantitatively). As illustrated in Figure 1 , the generated images of both DreamBooth and Anti-DreamBooth are recognized, i.e., there exists an evident face in the image. Besides, the generated face can even be correctly identified, i.e., being classified as the same identity by a face recognition algorithm. These undesired issues of privacy information leakage become the motivation of our work.In this paper, we propose DisDiff, a novel adversarial attack method against diffusion-based customization. We first delve into the training process of DreamBooth through the lens of the attention mechanism. As training proceeds, the diffusion model gradually establishes the association between "sks person" and the target individual. This association can be reflected by the cross-attention maps in the UNet [35] , which serves as the core guidance of text-image generation. In light of this, we propose a novel Cross-Attention Erasure module (CAE), to diminish the cross-attention's guiding effects. On the other hand, we explore the impact of the sampling procedure of diffusion models on adversarial attacks inspired by [44] . We compute Hybrid Quality Scores (HQS) for different timesteps to measure the importance of these steps on adversarial learning. Then, we introduce the Merit Sampling Scheduler (MSS) to adaptively modulate the PGD step sizes during attack, i.e., at the steps where HQS is large, PGD step size is magnified by MSS and vice versa. Both CAE and MSS modules are empirically proven to boost the adversarial attack performances on diffusion-based customizations.In brief, our contributions are summarised as follows:1) We propose DisDiff, a proactive adversarial attack method against diffusion-based customization, to protect users' privacy.2) We delve into the image-text relationship and justify its importance on generation guidance. On this basis, we propose a novel Cross-Attention Erasure module to "erase" the subject-identifier token-related attention map.3) Observing the diffusion sampling process and PGD, we introduce a Merit Sampling Scheduler, which restricts the perturbation updating step length in a step-aware manner.4) Experiments show that DisDiff outperforms the SOTA method by 12.75% of FDFR scores and 7.25% of ISM scores across two facial benchmarks and commonly used prompts on average. 
related work 2.1 text-to-image diffusion: 
 As latent-variable generative models, diffusion models establish a Markov chain of continuous timesteps to gradually introduce Gaussian noise into the training data. Afterward, the models learn to reverse the diffusion process and reconstruct data samples from the induced noises. In response to the growing demand for multimedia generation, considerable research efforts have been devoted to exploring text-to-image diffusion models. Stable Diffusion (SD) [40] , rooted in the Latent Diffusion Models [34] , significantly amplifies the scope of text-to-image synthesis applications.With the input of Gaussian noises and user-elaborated prompts, SD generates diversified images through the denoising process. It has been demonstrated that the text prompts serve as an essential controller for image generation, with even minor modifications leading to significantly different outcomes. A body of works focuses on the role of image-text relationships in the generation, which is known as attention maps. For precise SD text-to-image generation, Prompt-to-Prompt [14] explores cross-attention layers during the diffusion backward inference process. Attend-and-Excite [5] modifies the latent codes by maximizing the dominant attention values for each subject token.Despite the diversity of generated images by diffusion models, users often seek to synthesize specific concepts for their personal subjects. This task is named user customization [3, 22, 31, 47] and has been widely studied. LoRA [16] enables the diffusion models for specific styles or tasks by fine-tuning the extra parameters. This technique allows the model to associate image representations with the prompts describing them effectively. Textual Inversion [11] harnesses the diffusion models to reflect a novel concept to a pseudoword, denoted as 𝑆 * , within the malleable word embedding space of the text encoder. It allows for the seamless integration of unique concepts into the generative process, enhancing the model's ability to produce tailored and specific imagery.DreamBooth [37] fine-tunes the diffusion model with a subjectidentifier token consisting prompt (e.g., "a photo of sks person") and several images of the indicated subject. Through this process, the model becomes "familiar" with recognizing features associated with "sks person, " enabling it to generate various representations in response to different prompts. Despite the convenience of diffusionbased customization, there exist some potential risks. Malicious users may misuse these tools to invade privacy, for instance, generating illicit pornographic images or harmful content. Such misuse highlights the importance of ethical considerations and robust safeguards in the development of text-to-image synthesis technologies.Recognizing the urgency for privacy protection, researchers have introduced adversarial attacks to defend against malicious image manipulations. Inspired by adversarial attacks against classification tasks [1, 9, 27, 55] , Yeh et al. [52] and Ruiz et al. [36] aim at distorting or neutralizing image editing DeepFake techniques. He et al. [13] harness the StyleGAN inversion technique, encoding the protected images into latent space and adding perturbations. CMUA-Watermark [17] and TAFIM [2] further train universal watermarks against various image manipulations.Within the realm of diffusion-based customization for privacy protection, GLAZE [39] and AdvDM [23] employ invisible perturbations on personal images, protecting users from style theft and painting imitation. Differently, Anti-DreamBooth devises to generate adversarial noises and distort the outputs of customized diffusion methods, especially DreamBooth. SimAC [43] further takes a sense of the perception in the frequency domain of images and leverages a greedy algorithm to select timesteps. Different from them, our DisDiff sets out from the image-text relationship and disrupts the internal textual guidance. Besides, we take into consideration the integration of diffusion sampling and adversarial learning and introduce the Merit Sampling Scheduler to adaptively restrict the perturbation updating amplitude. 
method 3.1 preliminaries: 
 Stable Diffusion consists of an autoencoder and a conditional UNet [35] denoiser. Firstly, the encoder E (•) is devised to map a given image 𝑥 ∈ 𝑋 into a spatial latent code 𝑧 = E (𝑥). The decoder D is then trained to map the latent code back to the input image such that D (E (𝑥)) ≈ 𝑥. Secondly, the conditional denoiser 𝜖 𝜃 (•) is performed to predict the added noises guided by the text prompt 𝑦. At this time, a pre-trained CLIP [30] text encoder 𝑐 (•) is used to generate text embeddings. Representing the prompt 𝑦 as a conditioning vector denoted by 𝑐 (𝑦), the diffusion model 𝜖 𝜃 is trained to minimize the loss function:EQUATIONDuring inference, latent 𝑧 𝑇 is sampled from N (0, I) and progressively denoised to yield the latent 𝑧 0 . Subsequently, 𝑧 0 is fed into the decoder to generate the image 𝑥 ′ = D (𝑧 0 ). DreamBooth fine-tunes the diffusion model parameters for user customization. The training dataset consists of a subject-specific set 𝑋 𝑠 and a class-specific set 𝑋 𝑐 , accompanied by corresponding prompts 𝑦 𝑠 and 𝑦 𝑐 , e.g., "a photo of sks [class noun]" and "a photo of [class noun]", respectively. 𝑋 𝑠 comprises various personal images, while 𝑋 𝑐 serves to mitigate model overfitting. Therefore, Dream-Booth utilizes a two-part loss to train the diffusion models:EQUATIONwhere 𝜆 𝐷𝐵 represents a balanced hyper-parameter. In the inference process, users modify the subject-specific prompt to their desire, e.g., "a photo of sks [class noun] on the mountain". The model then generates this specific subject on the mountain as described.Adversarial attacks manipulate model 𝑓 by introducing imperceptible perturbations to the input data. As to the image generation, the attacker aims to distort or nullify the generation model's outputs by an optimal perturbation 𝛿. The perturbations are bounded within an 𝜂-ball according to distance metric ℓ 𝑝 , where 𝜂 represents the maximum allowed perturbation magnitude. The goal of adversarial attacks is to maximize the loss function, ensuring the outputs are different from the ground truth 𝑦 𝑡𝑟𝑢𝑒 . 𝛿 𝑎𝑑𝑣 is optimized by: 𝛿 adv = arg max 𝐿(𝑓 (𝑥 + 𝛿), 𝑦 true ), 𝑠.𝑡 .∥𝛿 ∥ 𝑝 ≤ 𝜂.(EQUATIONProjected Gradient Descent (PGD) [27] is a widely used method for adversarial attacks. The perturbations are computed by disrupting the input along the direction of Eq.3 iteratively. Every iteration process of PGD updates the adversarial example 𝑥 ′ as follows: where Π 𝑥,𝜂 (𝑧) confines the pixel values of 𝑧 within the 𝜂-ball, 𝛾 represents the step size, and 𝑘 denotes the number of iterations.EQUATIONEQUATIONMotivation. As in the literature [5, 14] , cross-attention maps represent the influence of tokens on image pixels, which control the text-guided image generation in the diffusion model. Thus, we first delve into the training process of DreamBooth through the lens of attention maps. Specifically, given a textual guidance composed of sequence 𝑊 = {𝑤 1 , 𝑤 2 , ..., 𝑤 𝑛 }, we derive the corresponding attention maps 𝑀 = {𝑚 1 , 𝑚 2 , ..., 𝑚 𝑛 }, where n is the word number. At timestep 𝑡, 𝑚 𝑡 is computed through the diffusion forward process with latent code 𝑧 𝑡 :EQUATIONwhere query 𝑄 is equal to 𝑊 𝑄 • 𝑐 (𝑦), key 𝐾 is equal to 𝑊 𝐾 • 𝑐 (𝑦). 𝑊 𝑄 and 𝑊 𝐾 are weight parameters of the query and key projection layers and 𝑑 is the channel dimension of key and query features. Notably, we aggregate these attention maps by averaging across all 16 × 16 attention layers and heads, as they are proved to convey the most semantic information [14] . Besides, it is observed that the original attention maps may not fully reflect whether an object is generated in the image [5] . In other words, a single patch with high attention value might originate from partial information passed from the token. To mitigate this, we further apply a Gaussian filter over 𝑚 𝑡 , which ensures that the attention value of the maximallyactivated patch depends on its neighboring patches, facilitating a smoother attention distribution across the image.Figure 3 shows the visualizations of attention maps. As the customization prompt is characterized by a subject-identifier token 𝑤 𝑠 ("sks") and a class-identifier token 𝑤 𝑐 ("person"), we maintain our focus on their related attention maps. The red highlighted areas reveal high relativity between the token and the generated image. Clearly, for unprotected subjects, the fine-tuned diffusion model successfully associates the subject-identifier token "sks" with faces. However, the class-identifier token "person" becomes less prominent. That is, "sks" actually stands on the subject. We compute the relative energy of the subject-identifier token by:EQUATIONwhere 𝑚 𝑠 is the attention map of 𝑤 𝑠 and 𝐴 stands on the pixel value in the maps. 𝐸 (𝑚 𝑠 ) reflects the energy weight percentage of the subject-identifier token. To protect personal privacy from customization, we thereby try to "erase" the energy associated with the values in 𝑚 𝑠 . Concretely, the proposed Cross-Attention Erasure loss is as follows:EQUATION)Our adversarial attack focuses on maximizing 𝐿 𝑐𝑎𝑒 , and the optimal perturbation 𝛿 can be learned by training procedure in Section 3.4. The intuition of our CAE module is that after erasing the crossattention map of the subject-identifier token (with eliminated highlighted areas), the model would lose the direction of text guidance. As a result, the generated images would exclude the identity information or even the subjects themselves. The protecting results are shown in the last two rows in Figure 3 . Compared with highlighted red areas of unprotected DreamBooth(the first two rows), the impact of the subject-identifier token on image generation dramatically decreases. In light of this, the learned perturbations distort imagetext correlations of the diffusion model, affecting unidentified or unrecognized inference outputs.Note that in the adversarial learning procedure of DisDiff, the timestep sampling process of diffusion models is included. Thus, to evaluate the importance of steps for adversarial learning, we adopt the Hybrid Quality Score (HQS) metric inspired by [44] . Assuming that 𝐺 𝑡 is the computed gradients on images, we first calculate the L1 norm of the gradients by:EQUATION)𝐺 𝑡 is then converted by a softmax function to the confident map 𝑝 𝑡 . The entropy is computed by:EQUATIONAfterward, the sequences 𝑁 = {𝑁 1 , 𝑁 2 , ..., 𝑁 𝑇 } and 𝐻 = {𝐻 1 , 𝐻 2 , ..., 𝐻 𝑇 } are normalized to [0,1] and the HQS metric is computed as:EQUATIONFigure 4 shows the HQS evaluation of various timesteps. High HQS stands on high values of gradient norm and low entropy, indicating that the model pays more attention at this timestep and mainly focuses on identity-related areas (such as faces). During early iterations when HQS is high, larger PGD steps may be beneficial for adversarial attacks. Conversely, as the HQS decreases, smaller PGD steps can help fine-tune the generated adversarial samples, as well as avoid excessive deviation from the original input distribution. Besides, we also visualize the cross-attention map of the subjectidentifier token for different timesteps. As can be seen, when the timesteps are large, the model pays more attention to the irrelevant information of the identity. As the timestep gets smaller, the attention gradually moves to the identity's faces. Observations on HQS and attention maps both empirically justify that the timesteps sampling is essential to adversarial attacks. return 𝑆𝐷 8: end procedure 9: For 𝑡 in {1, 2, ..., 𝑡 1 } : 𝑆𝐷 ← 𝐷𝐵𝑆𝑇 𝐸𝑃 (𝑆𝐷, 𝑋 𝑎𝑑𝑣 ,𝑊 ) Therefore, we resort to adopting a time-dependent function as the Merit Sampling Scheduler (MSS) to adjust the perturbation updating steps in PGD adaptively. We empirically design the timeaware decreasing function as:EQUATION)where 𝑇 is the max timestep to sample so that the amplitude of ℎ(𝑡) is limited in [0,1]. In this regard, our proposed MSS dynamically adjusts the step size of the perturbation updating. The scheduler is then used to be an enhancement for PGD attacks. Given the overall loss 𝐿, PGD process in Eq.5 is modified as:EQUATION)By incorporating MSS, we associate adversarial learning with the diffusion model sampling process. The modified PGD updates the perturbations precisely, contributing to better attack performances.To sum up, the proposed DisDiff combines the DreamBooth loss with the Cross-Attention Erasure loss as the overall loss:EQUATION)where 𝜆 is a trade-off hyper-parameter. To conduct the adversarial attack, we utilize modified PGD (Eq.13) and maximize the loss function to train the perturbations:EQUATION)We conduct an alternative training strategy similar to [42]  
experiments 4.1 experimental setup: 
 Evaluation Benchmarks. We quantitatively evaluate our approach on two benchmarks: CelebA-HQ [26] and VGGFace2 [4] . For each dataset, we choose 50 identities as the protecting subjects. 8 different images are prepared for each subject and divided equally into two subsets: the clean image set and the target protection set. All images undergo center-cropping and resizing procedures, resulting in a uniform resolution of 512 × 512.DreamBooth and Adversarial Attack Procedures. We address three versions of pre-trained SD from HuggingFace [10] : v1.4, v1.5 and v2.1. For DreamBooth, the text-encoder and UNet model are trained with a batch size of 2 and the learning rate of 5×10 -7 for 1,000 training steps. The prompt is "a photo of sks person" for the subject images and "a photo of person" for class-specific datasets. The PGD attack is configured with 𝛾 = 0.005 and a default noise budget 𝜂 = 0.05 for VGGFace2 and 0.07 for CelebA-HQ respectively. We train the perturbations by 50 iterations, each containing 3 steps Evaluation Metrics. We utilize two widely used image quality metrics, FID [15] and BRISQUE [28] , to test the disrupting results. Besides, images generated from these models may lack detectable faces, which we quantify as the Face Detection Failure Rate (FDFR), measured by the RetinaFace detector [7] . We also extract face recognition embeddings using the ArcFace recognizer [8] and compute the cosine distance to the average face embedding of the entire user's clean image set, referred to as Identity Score Matching (ISM).We conduct comparisons with two SOTA anti-customization baselines: AdvDM [23] and Anti-DreamBooth [42] . For a fair comparison, we reproduce their source codes and train adversarial examples with equivalent noise budgets. These protected examples are then used to fine-tune the diffusion models (DreamBooth), with prompt "a photo of sks person. " Then, the trained diffusion models are tested by prompts "a photo of sks person" and "a dslr portrait of sks person". As can be seen in Table 1 , our method demonstrates notable performances across four metrics and two prompts. Specifically, higher FDFR rates signify a decreasing number of detected faces, while lower ISM rates indicate less similarity with the original subject. Increased FID and BRISQUE rates emphasize the lower image quality, resulting in significant distortions of the outputs.To further verify the efficacy, we also test our method under various prompts with distance, expression, action, and location descriptions, respectively. As shown in Figure 5 , DreamBooth edits the images as the prompts describe. AdvDM pushes the outputs to the target image so that the results show a similar texture to that image. Although Anti-DreamBooth distorts the output images, the identity is still recognizable. Our proposed DisDiff leads to more unrecognized faces and unidentified subjects by directly disrupting the cross-attention module, which greatly boosts the performances.Impact of Cross-Attention Erasure. To testify to the impacts of our proposed Cross-Attention Erasure, we visualize the attention maps and the corresponding generated images. As shown in the first row of Figure 7 , highlighted red areas occur on the identity face for the token "sks", which indicates that the diffusion model pays much more attention to the learned identity with "sks". This is intuitive since DreamBooth progressively makes the token "sks" and the special person connected closely. This situation still exists when the identity is protected by AdvDM and Anti-DreamBooth, which is undesired for privacy protection. Compared with them, DisDiff successfully erases the impact of "sks". That is, the diffusion model ignores the token "sks" and its guidance on generation, thus has no idea about whom to generate. The images protected with our method thus exhibit greater blurriness and indistinctiveness.Module and Scheduler Selection. We conduct the ablation study of the proposed Cross-Attention Erasure (CAE) and Merit Sampling Scheduler (MSS) modules. As shown in Figure 6 (a), we set the metrics of baseline method Anti-DreamBooth as 1 and calculate the relative magnitude of DisDiff. Clearly, when utilizing CAE or MSS, the lower ISM and higher FDFR illustrate that the customization outputs become unidentified and unrecognized, indicating DisDiff's effectiveness. Also, we apply two widely used decreasing functions to serve as the scheduler in MSS: the logarithm decreasing function 1 and diffusion models sampling sequence ᾱ𝑡 . We set the scheduler in Eq.12 as the baseline and compare the attack performances in Figure 6(b) . Finally, we select the cosine function in Eq.12 as the default, which achieves the lowest ISM rate. 1 The logarithm decreasing function is 1 -𝑙𝑜𝑔 (𝑡 +1) 𝑙𝑜𝑔 (𝑇 +1) , where T is the max sampling step. Noise Budget. The noise budget 𝜂 represents the permissible magnitude of perturbations, and a large noise budget is easily perceptible by humans. LPIPS is used to measure the image quality before and after attack. As shown in Table 2 , DisDiff shows high FID and BRISQUE scores when the budget is as small as 0.03. Besides, LPIPS is still low when we set 𝜂 = 0.05(default), meaning that the perturbation is still invisible. Moreover, the attack performances become stronger as the budget increases, which is also reasonable since the larger the perturbation is, the greater the attack performances can be achieved.Attacks on different generators. Considering the potential malicious uses of DreamBooth across different diffusion model generators, we conduct experiments to assess the impact. As shown in Table 3 , we first test under the self-surrogate setting (indicated "self"), where the perturbation training and DreamBooth models are the same version. Experiments show that DisDiff achieves better performances than Anti-DreamBooth and generalizes well on SD v1.4 and v1.5. Then, we test the generated perturbations robustness under different generators (indicated "v2.1"). We employ the adversarial examples generated with SD v2.1 to train DreamBooth under v1.4 and v1.5. The FDFR approaches 1.0 and ISM approaches Attacks while prompt or subject-identifier mismatching. Assuming that the adversarial learning prompts differ from the ones used to train DreamBooth, we conduct experiments to test the robustness, as illustrated in Table 4 . In the first row, we employ "a photo of sks person" for adversarial learning and "a photo of a dslr portrait of sks person" for DreamBooth, conducting inference for both. DisDiff and Anti-DreamBooth perform poorly when confronted with the prompt "a photo of sks person" due to prompt mismatching. However, when presented with the prompt "a dslr portrait of sks person", DisDiff demonstrates superior performances. This is partially due to that the training prompt becomes more complicated and the models are overfitting.We also evaluate the results by changing the DreamBooth subjectidentifier token to "t@t", as in the second row. Our DisDiff remains well-generalized to "t@t". The reason is that we apply the softmax function in CAE. The summary of all the softmax attention maps for every pixel is 1. After erasing the attention map of "sks", the values of other tokens become larger. As a result, the attention map of substitute token "t@t" is erased even though it is not involved in perturbation training. To sum up, DisDiff is robust to different DreamBooth prompts and subject-identifier tokens.Attacks on different customization methods. To verify our protection generality across various generation methods, we reproduce wildly used customization methods: Low-rank Adaptation (LoRA) [16] and Textual Inversion (TI) [11] . We train customization with LoRA and TI and conduct adversarial attacks with Anti-DreamBooth and DisDiff. As can be seen in Table 5 , compared to unprotected DreamBooth, both Anti-DreamBooth and DisDiff successfully attack these two customization methods. DisDiff shows  
conclusion: 
 In this paper, we propose a novel adversarial attack method, Disrupting Diffusion (DisDiff). We track the cross-attention maps and propose a Cross-Attention Erasure module to disrupt these maps. We also introduce a time-aware Merit Sampling Scheduler to adaptively adjust the PGD steps. DisDiff successfully disrupts customization's outputs as unrecognizable and unidentifiable. 
 
 Appendix:  


Decision: Summary:

This paper presents DisDiff, a proactive adversarial attack method aimed at preserving privacy in diffusion-based image customization. It introduces a Cross-Attention Erasure (CAE) module and a Merit Sampling Scheduler (MSS) to disrupt the generation of identifiable images and improve privacy protection.

Strengths:
1. The paper introduces a novel method named DisDiff, which addresses privacy leakage in diffusion-based customization.
2. Extensive experiments demonstrate DisDiff's superiority over state-of-the-art techniques, with improvements in privacy protection metrics.
3. The paper is well-written and organized, with clear visualizations that enhance the understanding of the proposed method.

Limitations:
1. The relationship between the CAE and MSS modules needs clearer explanation, and the theoretical impact of cross-attention erasure on diffusion requires further analysis.
2. The robustness of DisDiff against various image distortions and in uncontrolled settings needs more thorough evaluation.
3. Visualization comparisons and some practical considerations are lacking in the paper such as the explanation of noise budgets.

I will temporarily recommend this paper as Accept (Poster) without complete confidence. This case is very special, where all reviewers had positive initial ratings, while two of them changed their decision to Borderline Reject after reading the rebuttal. Therefore, I sincerely consider this case needs to be discussed.

Reviews: review: paper_summary: paper_summary: The paper presents a novel method to solve the privacy leakage problem caused by customization based on diffusion model, \emph{i.e.,} DisDiff, a proactive adversarial attack method for privacy preservation. The authors also explore the image-text relationship to justify its importance on generation guidance, based on which a novel cross-attention erasure module to eliminate the subject-identifier token-related attention map. Besides, a merit sampling scheduler is introduced to restrict the perturbation updating step length in a step-aware manner.
strength_weakness: strength_weakness: 1.	The idea of solving privacy issue in diffusion-based customization by cross-attention is novel.
2.	The Experiments indicate the superiority of the work.
limitations: limitations: 1.	Figure 1 well indicates the superiority of the proposed DisDiff to Anti-DB and the motivations of the DisDiff. However, it may not well illustrate the target application case.
2.	DisDiff includes two modules, and the relationship between the two modules should be specified.
3.	It would be better to analyze the influence of cross attention erasure on the diffusion theoretically, if possible.
paper_summary: paper_summary: This paper delves into the image-text relationships in diffusion models that find the subject-identifier tokens are easily disturbed. 
Then, the authors propose a cross-attention erasure module to explicitly ``erase’’ privacy information, achieving better protection performance than Anti-DreamBooth.
strength_weakness: strength_weakness: 1.  The motivation of the cross-attention erasure module is well delivered. Visualization of the cross-attention map is very helpful.
2. A Merit Sampling Scheduler is proposed to guide the perturbation updating step length in PGD.
3. The paper is clearly written and organized. Extensive experiments are conducted to evaluate the effectiveness of DisDiff.
limitations: limitations: 1. Visualization comparison between the original image and protected counterpart is not shown.
2. The robustness of DisDiff is poor, as shown in Table 6. Gaussian Blur and JPEG Compression can easily corrupt its effectiveness. More image distortions are not discussed. Additionally, what's the meaning of "No attack, no preproc."? It's not illustrated in the main paper.
3.  In Table 4, why did training while testing on SD v1,4 achieve better performance than on training and testing on the same model (Self)?
4. Efficiency of DisDiff should be considered.
paper_summary: paper_summary: This paper proposes Disrupting Diffusion (DisDiff), an effective new approach to proactively disrupt facial image customization and protect user privacy by erasing key attention guidance and adapting to the diffusion sampling process during the adversarial attack.
strength_weakness: strength_weakness: 1. DisDiff introduces the Cross-Attention Erasure (CAE) module, which directly targets and "erases" the critical attention maps that guide the diffusion model to generate the customized subject. By disrupting this key mechanism, DisDiff effectively prevents the model from generating identifiable images of the protected individual.
2. The Merit Sampling Scheduler (MSS) analyzes the importance of each timestep in the diffusion sampling process and adaptively adjusts the adversarial attack's perturbation update step size. This allows DisDiff to more effectively disrupt the model by focusing the attack on the most impactful timesteps.
3. Experiments demonstrate that DisDiff outperforms state-of-the-art adversarial attack methods, achieving a 12.75% higher face detection failure rate (FDFR) and 7.25% lower identity score matching (ISM) on average. DisDiff is also shown to be robust across various customization methods.
limitations: limitations: 1. Does DisDiff generalize to objects other than malicious customizations of facial images?
2. While the paper does test robustness to Gaussian blur and JPEG compression, there are many other common pre-processing steps that could impact the effectiveness of the adversarial attacks, such as resizing, cropping, color space transformations, etc. A more thorough evaluation of robustness to a wider range of pre-processing would strengthen the results.
3. The paper sometimes uses the abbreviation "DB" for "DreamBooth" without first defining it, e.g. in Table 3 and a few other places. It would be better to define this abbreviation on first use.
paper_summary: paper_summary: This paper proposes an adversarial attack against diffusion-based customization, to protect human privacy. The proposed attack disrupts the mapping relationship between the trigger word and the input images through a Cross-Attention Erasure module. In addition, they adopt a Merit Sampling Scheduler to restrict the perturbation updating step length in a step-aware manner. Finally, the proposed method achieves excellent performance compared with Sota methods.
strength_weakness: strength_weakness: - S1: This paper conducts comprehensive experiments and the proposed method is superior to Sota methods.
  
- S2: This paper has a clear logic and shows reasonable explanations for the erasure module and perturbation updation strategy.
limitations: limitations: - W1: The authors would better consider "Uncontrolled Settings" which have been considered in Anti-DreamBooth. I am curious about the effectiveness of the proposed method when the input images consist of both clean images and adversarial images.
  
- W2: The authors evaluate the proposed attack on DreamBooth, Low-rank Adaptation (LoRA), and Textual Inversion (TI). However, these methods need much time for tuning and many tuning-free customization approaches, such as PhotoMaker (https://arxiv.org/abs/2312.04461) and IPAdapter (https://arxiv.org/abs/2308.06721), have been proposed. Therefore, the author would better evaluate the proposed method on the Sota customization methods.
  
- W3: Although this paper analyzes the noise budget in the ablation study, it still lacks the visualization results of the adversarial images. Some noises are visible to humans, and image quality metrics such as LPIPS cannot effectively reflect them.
  
- W4: Finally, there are several small questions:
  
  - In line 564, the noise budgets for VGGFace2 and CelebA-HQ are set as 0.05 and 0.07, respectively. I notice that the two budgets in Anti-DreamBooth are both set as 0.05. What is the basis for choosing different thresholds?
  - In Table 1, it seems unnecessary to display a reference column. By the way, the authors would like to update the reference information in the Reference Section from Arxiv versions to published versions.
  - In lines 790-791, if you don't provide the results of Custom Diffusion in Table 3, it seems unnecessary to mention it here.