Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch

• URL: http://arxiv.org/abs/2603.13028v1
• Date: Fri, 13 Mar 2026 14:36:46 GMT
• Title: Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch
• Abstract summary: Diffusion models enable high-fidelity image editing but can also be misused for unauthorized style imitation and harmful content generation.<n>To mitigate these risks, proactive image protection methods embed small, often imperceptible adversarial perturbations into images before sharing to disrupt downstream editing or fine-tuning.<n>We introduce a unified post-release purification framework to evaluate protection survivability under model mismatch.
• Score: 21.826849937304477
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Diffusion models enable high-fidelity image editing but can also be misused for unauthorized style imitation and harmful content generation. To mitigate these risks, proactive image protection methods embed small, often imperceptible adversarial perturbations into images before sharing to disrupt downstream editing or fine-tuning. However, in realistic post-release scenarios, content owners cannot control downstream processing pipelines, and protections optimized for a surrogate model may fail when attackers use mismatched diffusion pipelines. Existing purification methods can weaken protections but often sacrifice image quality and rarely examine architectural mismatch. We introduce a unified post-release purification framework to evaluate protection survivability under model mismatch. We propose two practical purifiers: VAE-Trans, which corrects protected images via latent-space projection, and EditorClean, which performs instruction-guided reconstruction with a Diffusion Transformer to exploit architectural heterogeneity. Both operate without access to protected images or defense internals. Across 2,100 editing tasks and six representative protection methods, EditorClean consistently restores editability. Compared to protected inputs, it improves PSNR by 3-6 dB and reduces FID by 50-70 percent on downstream edits, while outperforming prior purification baselines by about 2 dB PSNR and 30 percent lower FID. Our results reveal a purify-once, edit-freely failure mode: once purification succeeds, the protective signal is largely removed, enabling unrestricted editing. This highlights the need to evaluate protections under model mismatch and design defenses robust to heterogeneous attackers.

Related papers

• MIRAGE: Protecting against Malicious Image Editing via False Moderation [73.0838743416626]
  Prior work on image immunization adds imperceptible perturbations to an image to protect against unauthorized manipulations.<n>We take a system-level view of the problem and identify a previously unexplored attack surface common to all major commercial image editing systems.<n>We propose to immunize images by causing these moderations to flag images as policy-violating, triggering an automatic refusal regardless of the editing prompt.
  arXiv  Detail & Related papers  (2026-06-24T16:23:10Z)
• Bypassing Copyright Protection in Diffusion-based Customization via Two-Stage Latent Feature Optimization [51.33055188976282]
  adversarial attacks have emerged as a prominent defense strategy to prevent malicious content forgery in personalized image generation.<n>We introduce Two-Stage Latent Feature Optimization (TS-LFO), an efficient and effective copyright-stealing attack against protected diffusion-based customization.<n>Extensive experiments show that TS-LFO consistently bypasses state-of-the-art (SOTA) copyright defenses and outperforms SOTA copyright attacks such as DiffPure, GrIDPure and IMPRESS.
  arXiv  Detail & Related papers  (2026-06-06T07:59:08Z)
• Safeguarding Text-to-Image Generative Models Against Unauthorized Knowledge Distillation [49.23010932057819]
  We present WaveGuard, a single-pass, generator-based protection framework for closed-weight generative services.<n>WaveGuard safeguards released synthetic images under a user-specified perturbation budget.
  arXiv  Detail & Related papers  (2026-05-21T06:50:50Z)
• Towards Transferable Defense Against Malicious Image Edits [70.17363183107604]
  Transferable Defense Against Malicious Image Edits (TDAE) is a novel bimodal framework that enhances image immunity against malicious edits.<n>We introduce FlatGrad Defense Mechanism (FDM), which incorporates gradient regularization into the adversarial objective.<n>For textual enhancement protection, we propose Dynamic Prompt Defense (DPD), which periodically refines text embeddings to align the editing outcomes of immunized images with those of the original images.
  arXiv  Detail & Related papers  (2025-12-16T12:10:16Z)
• AdLift: Lifting Adversarial Perturbations to Safeguard 3D Gaussian Splatting Assets Against Instruction-Driven Editing [109.07334219188222]
  We propose the first editing safeguard for 3DGS, termed AdLift, which prevents instruction-driven editing across arbitrary views and dimensions.<n>We alternate between gradient truncation and image-to-Gaussian fitting, yielding consistent adversarial-based protection performance across different viewpoints.
  arXiv  Detail & Related papers  (2025-12-08T07:41:23Z)
• Adapter Shield: A Unified Framework with Built-in Authentication for Preventing Unauthorized Zero-Shot Image-to-Image Generation [74.5813283875938]
  Zero-shot image-to-image generation poses substantial risks related to intellectual property violations.<n>This work presents Adapter Shield, the first universal and authentication-integrated solution aimed at defending personal images from misuse.<n>Our method surpasses existing state-of-the-art defenses in blocking unauthorized zero-shot image synthesis.
  arXiv  Detail & Related papers  (2025-11-25T04:49:16Z)
• Towards Robust Defense against Customization via Protective Perturbation Resistant to Diffusion-based Purification [20.862062527487794]
  Protective perturbations mitigate image misuse by injecting imperceptible adversarial noise.<n> purification can remove protective perturbations, thereby exposing images again to the risk of malicious forgery.<n>AntiPure embeds imperceptible perturbations that persist under representative purification settings, achieving effective post-customization distortion.
  arXiv  Detail & Related papers  (2025-09-17T11:30:13Z)
• Is Perturbation-Based Image Protection Disruptive to Image Editing? [4.234664611250363]
  Current image protection methods rely on adding imperceptible perturbations to images to obstruct diffusion-based editing.<n>A fully successful protection for an image implies that the output of editing attempts is an undesirable, noisy image.<n>We argue that perturbation-based methods may not provide a sufficient solution for robust image protection against diffusion-based editing.
  arXiv  Detail & Related papers  (2025-06-04T19:20:37Z)
• GuardDoor: Safeguarding Against Malicious Diffusion Editing via Protective Backdoors [8.261182037130407]
  GuardDoor is a novel and robust protection mechanism that fosters collaboration between image owners and model providers.<n>Our method demonstrates enhanced robustness against image preprocessing operations and is scalable for large-scale deployment.
  arXiv  Detail & Related papers  (2025-03-05T22:21:44Z)
• Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? [21.75921532822961]
  We introduce a purification method capable of removing protected perturbations while preserving the original image structure. Experiments reveal that Stable Diffusion can effectively learn from purified images over all protective methods.
  arXiv  Detail & Related papers  (2023-11-30T07:17:43Z)
• IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI [52.90082445349903]
  Diffusion-based image generation models can create artistic images that mimic the style of an artist or maliciously edit the original images for fake content. Several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations. In this work, we introduce a purification perturbation platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure.
  arXiv  Detail & Related papers  (2023-10-30T03:33:41Z)
• JPEG Compressed Images Can Bypass Protections Against AI Editing [48.340067730457584]
  Imperceptible perturbations have been proposed as a means of protecting images from malicious editing. We find that the aforementioned perturbations are not robust to JPEG compression.
  arXiv  Detail & Related papers  (2023-04-05T05:30:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.