Diffusion-based image generation models, such as Stable Diffusion or DALL-E 2, are able to learn from given images and generate high-quality samples following the guidance from prompts. For instance, they can be used to create artistic images that mimic the style of an artist based on his/her original artworks or to maliciously edit the original images for fake content. However, such ability also brings serious ethical issues without proper authorization from the owner of the original images. In response, several attempts have been made to protect the original images from such unauthorized data usage by adding imperceptible perturbations, which are designed to mislead the diffusion model and make it unable to properly generate new samples. In this work, we introduce a perturbation purification platform, named IMPRESS, to evaluate the effectiveness of imperceptible perturbations as a protective measure. IMPRESS is based on the key observation that imperceptible perturbations could lead to a perceptible inconsistency between the original image and the diffusion-reconstructed image, which can be used to devise a new optimization strategy for purifying the image, which may weaken the protection of the original image from unauthorized data usage (e.g., style mimicking, malicious editing). The proposed IMPRESS platform offers a comprehensive evaluation of several contemporary protection methods, and can be used as an evaluation platform for future protection methods.
SITA: Structurally Imperceptible and Transferable Adversarial Attacks for Stylized Image Generation
School of Future Technology, South China University of Technology（华南理工大学未来技术学院）；School of Computer Science and Engineering, South China University of Technology（华南理工大学计算机科学与工程学院）；School of Computer Science and Technology, Ocean University of China（中国海洋大学计算机科学与技术学院）；School of Computing and Information Systems, Singapore Management University（新加坡管理大学计算与信息系统学院）
Protecting Your Video Content: Disrupting Automated Video-based LLM Annotations
Tsinghua University（清华大学）；ByteDance（字节跳动）；Digital Center, China Merchants Group Limited（招商银行集团数字中心）；Shenzhen University（深圳大学）；Peng Cheng Laboratory（鹏城实验室）
VOID: Defeating Unauthorized Mimicry in Latent Diffusion Models
School of Cyber Science and Engineering, Wuhan University（武汉大学网络空间安全学院）；School of Computer Science, Wuhan University（武汉大学计算机学院）；Institute for Math&AI, Wuhan University（武汉大学数学与人工智能研究所）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；School of Cyber Science and Engineering, Xi’an Jiaotong University（西安交通大学网络空间安全学院）
Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitation
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Drexel University（德雷塞尔大学）；Shanghai Innovation Center for Processor Technologies, SHIC（上海处理器技术创新中心）
Lehigh University（理海大学）；South China University of Technology（华南理工大学）
The volume of open-source biomedical data has been essential to the development of various spheres of the healthcare community since more `free' data can provide individual researchers more chances to contribute. However, institutions often hesitate to share their data with the public due to the risk of data exploitation by unauthorized third parties for another commercial usage (e.g., training AI models). This phenomenon might hinder the development of the whole healthcare research community. To address this concern, we propose a novel approach termed `unlearnable biomedical image' for protec…
Dual Attention Guided Defense Against Malicious Edits
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences (CAS)（人工智能安全国家重点实验室，计算技术研究所，中国科学院）；University of China Academy of Sciences（中国科学院大学）；School of Computer Science, China University of Geosciences（中国地质大学（武汉）计算机学院）
Zhejiang University（浙江大学）；Huawei Noah’s Ark Lab（华为诺亚方舟实验室）；Shanghai Institute for Advanced Study of Zhejiang University（浙江大学上海高等研究院）；Shanghai AI Laboratory（上海人工智能实验室）
The success of deep learning is partly attributed to the availability of massive data downloaded freely from the Internet. However, it also means that users' private data may be collected by commercial organizations without consent and used to train their models. Therefore, it's important and necessary to develop a method or tool to prevent unauthorized data exploitation. In this paper, we propose ConfounderGAN, a generative adversarial network (GAN) that can make personal image data unlearnable to protect the data privacy of its owners. Specifically, the noise produced by the generator for ea…
Today's proliferation of powerful facial recognition systems poses a real threat to personal privacy. As Clearview.ai demonstrated, anyone can canvas the Internet for data and train highly accurate facial recognition models of individuals without their knowledge. We need tools to protect ourselves from potential misuses of unauthorized facial recognition systems. Unfortunately, no practical or effective solutions exist. In this paper, we propose Fawkes, a system that helps individuals inoculate their images against unauthorized facial recognition models. Fawkes achieves this by helping users a…
To See is Not to Learn: Protecting Multimodal Data from Unauthorized Fine-Tuning of Large Vision-Language Model
School of Computing；Augmented Intelligence, Arizona State University, Tempe, AZ, USA；Department of Computer Science；Engineering, Texas A\&M University, College Station, TX, USA
SPIN: Image Immunization Against Diffusion Editing via Single-Step Projection in Stochastic Neighborhoods
University of Chinese Academy of Sciences（中国科学院大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；Imperial College London（伦敦帝国理工学院）
Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Drexel University（德雷塞尔大学）；Shanghai Innovation Center for Processor Technologies, SHIC（上海处理器技术创新中心）
An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models
Sun Yat-sen University（中山大学）；Guangdong Provincial Key Laboratory of Information Security Technology（广东省信息安全技术重点实验室）；University of Florence（佛罗伦萨大学）；University of Siena（锡耶纳大学）；Qilu University of Technology (Shandong Academy of Sciences)（齐鲁工业大学（山东省科学院））
Semantic Mismatch and Perceptual Degradation: A New Perspective on Image Editing Immunity
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences (CAS)（人工智能安全国家重点实验室，计算技术研究所，中国科学院）；University of China Academy of Sciences（中国科学院大学）；Center for Machine Vision and Signal Analysis, University of Oulu（信号分析中心，奥卢大学）；School of Computer Science, China University of Geosciences（计算机科学学院，中国地质大学）
VoxShield: Protecting 3D Medical Datasets from Unauthorized Training via Frequency-Aware Inter-Slice Disruption
Westlake University（西拉雅大学）；Dalian University of Technology（大连理工大学）；Hokkaido University（北海道大学）；The Chinese University of Hong Kong（香港中文大学）；RIKEN（理化学研究所）
HoneyImage: Verifiable, Harmless, and Stealthy Dataset Ownership Verification for Image Models
Department of Information Systems, Business Statistics and Operations Management (ISOM), Hong Kong University of Science and Technology (HKUST)（信息系统、商业统计与运营管理系（ISOM），香港科技大学）
Anhui University（安徽大学）；University of Science and Technology of China（中国科学技术大学）
In order to prevent illegal or unauthorized access of image data such as human faces and ensure legitimate users can use authorization-protected data, reversible adversarial attack technique is rise. Reversible adversarial examples (RAE) get both attack capability and reversibility at the same time. However, the existing technique can not meet application requirements because of serious distortion and failure of image recovery when adversarial perturbations get strong. In this paper, we take advantage of Reversible Image Transformation technique to generate RAE and achieve reversible adversari…
Anhui University（安徽大学）；University Of Strathclyde（思克莱德大学）；East China Normal University（华东师范大学）
Adding perturbations to images can mislead classification models to produce incorrect results. Recently, researchers exploited adversarial perturbations to protect image privacy from retrieval by intelligent models. However, adding adversarial perturbations to images destroys the original data, making images useless in digital forensics and other fields. To prevent illegal or unauthorized access to sensitive image data such as human faces without impeding legitimate users, the use of reversible adversarial attack techniques is increasing. The original image can be recovered from its reversible…
Univ Lyon（里昂大学）；ENS de Lyon（里昂高等师范学院）；CNRS（法国国家科学研究中心）；UCBL（里昂第一大学）；DeepMind（深度思维）；University of Cambridge（剑桥大学）
Despite achieving impressive performance, state-of-the-art classifiers remain highly vulnerable to small, imperceptible, adversarial perturbations. This vulnerability has proven empirically to be very intricate to address. In this paper, we study the phenomenon of adversarial perturbations under the assumption that the data is generated with a smooth generative model. We derive fundamental upper bounds on the robustness to perturbations of any classification function, and prove the existence of adversarial perturbations that transfer well across different classifiers with small risk. Our analy…
DiffUE: Enhancing Utility-Unlearnability Trade-off of Unlearnable Examples via Diffusion Autoencoders
University of Tennessee, Knoxville（田纳西大学诺克斯维尔分校）；Oak Ridge National University, Knoxville（橡树岭国家实验室诺克斯维尔分部）；University of Georgia, Athens（佐治亚大学雅典分校）；Virginia Commonwealth University, Richmond（弗吉尼亚联邦大学里士满分校）
Unlearnable Examples Give a False Sense of Data Privacy: Understanding and Relearning
Institute of Computing Technology, CAS（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Shanghai Innovation Center for Processor Technologies（上海处理器技术创新中心）；Drexel University（德雷塞尔大学）
AdLift: Lifting Adversarial Perturbations to Safeguard 3D Gaussian Splatting Assets Against Instruction-Driven Editing
Sydney AI Centre, The University of Sydney（悉尼人工智能中心，悉尼大学）；University of Technology Sydney（技术大学悉尼）；University of Melbourne（墨尔本大学）；Hong Kong Baptist University（香港 Baptist 大学）；Mohamed bin Zayed University of Artificial Intelligence（Mohamed bin Zayed 人工智能大学）
DP^2-VL: Private Photo Dataset Protection by Data Poisoning for Vision-Language Models
Shandong University（山东大学）；Shanghai Jiao Tong University（上海交通大学）；Donghua University（东华大学）；Shanghai Normal University（上海师范大学）；East China Normal University（华东师范大学）；Hefei University of Technology（合肥工业大学）
Deep neural networks have achieved impressive results in many image classification tasks. However, since their performance is usually measured in controlled settings, it is important to ensure that their decisions remain correct when deployed in noisy environments. In fact, deep networks are not robust to a large variety of semantic-preserving image modifications, even to imperceptible image changes known as adversarial perturbations. The poor robustness of image classifiers to small data distribution shifts raises serious concerns regarding their trustworthiness. To build reliable machine lea…
