设计层面的脆弱性：论个性化生成中对抗防御的局限性
Fragile by Design: On the Limits of Adversarial Defenses in Personalized Generation
AI总结：
针对个性化生成中Anti-DreamBooth等对抗防御存在伪影明显、扰动易被移除的缺陷，提出AntiDB_Purify框架评估发现现有防御在真实净化威胁下均失效，指明需研发更鲁棒的身份防护方案。
摘要：
DreamBooth等个性化AI应用可基于用户图像生成定制化内容，但也引发了严重的隐私担忧，尤其是面部身份泄露风险。近期的防御机制如Anti-DreamBooth试图通过向用户照片注入对抗扰动来阻止成功的个性化过程，以缓解该风险。然而，我们发现这些方法存在两个关键且被忽视的局限性：其一，对抗样本往往存在可感知的伪影，例如显眼的图案或条纹，很容易被检测为经过篡改的内容；其二，扰动的脆弱性极高，即便使用简单的非学习型滤波器也能有效移除扰动，进而恢复模型记忆和复现用户身份的能力。为研究该漏洞，我们提出了新型评估框架AntiDB_Purify，在包含传统图像滤波器和对抗净化的真实净化威胁场景下系统评估现有防御方法。结果显示，当前所有方法在这类威胁下均无法维持防护效果。这些发现表明当前防御提供的是虚假安全感，凸显了亟需更隐蔽、鲁棒的防护手段来保障个性化生成场景下的用户身份安全。
英文摘要：
Personalized AI applications such as DreamBooth enable the generation of customized content from user images, but also raise significant privacy concerns, particularly the risk of facial identity leakage. Recent defense mechanisms like Anti-DreamBooth attempt to mitigate this risk by injecting adversarial perturbations into user photos to prevent successful personalization. However, we identify two critical yet overlooked limitations of these methods. First, the adversarial examples often exhibit perceptible artifacts such as conspicuous patterns or stripes, making them easily detectable as manipulated content. Second, the perturbations are highly fragile, as even a simple, non-learned filter can effectively remove them, thereby restoring the model's ability to memorize and reproduce user identity. To investigate this vulnerability, we propose a novel evaluation framework, AntiDB_Purify, to systematically evaluate existing defenses under realistic purification threats, including both traditional image filters and adversarial purification. Results reveal that none of the current methods maintains their protective effectiveness under such threats. These findings highlight that current defenses offer a false sense of security and underscore the urgent need for more imperceptible and robust protections to safeguard user identity in personalized generation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
