在扩散模型图像保护方法中解释结构扰动
Interpreting Structured Perturbations in Image Protection Methods for Diffusion Models
AI总结：
本研究通过分析扩散模型图像保护机制的结构化扰动，揭示其在特征层面的变形特性，为防御和检测策略设计提供新视角。
摘要：
最近的图像保护机制，如Glaze和Nightshade，引入了不可察觉的、对抗性设计的扰动，旨在破坏下游的文本到图像生成模型。尽管其经验有效性已知，但这些扰动的内部结构、可检测性和表征行为仍缺乏深入理解。本研究提供了一种系统且可解释的AI分析，采用统一框架整合白盒特征空间检查和黑盒信号级探测。通过潜在空间聚类、特征通道激活分析、基于遮挡的空间敏感性映射以及频域特性分析，我们表明保护机制操作为结构化、低熵扰动，紧密耦合于底层图像内容，跨表征、空间和频域领域。受保护的图像在内容驱动的特征组织上保留保护特定的子结构，而非引起全局表征漂移。可检测性由扰动熵、空间部署和频率对齐的相互作用决定，连续保护放大可检测结构而非抑制它。频域分析显示，Glaze和Nightshade在主导图像对齐的频率轴上重新分布能量，而非引入扩散噪声。这些发现表明，当代图像保护通过结构化特征级变形而非语义位移进行操作，解释了为什么保护信号仍保持视觉微妙但一致可检测。本工作推进了对抗性图像保护的可解释性，并为生成AI系统的未来防御和检测策略设计提供了指导。
英文摘要：
Recent image protection mechanisms such as Glaze and Nightshade introduce imperceptible, adversarially designed perturbations intended to disrupt downstream text-to-image generative models. While their empirical effectiveness is known, the internal structure, detectability, and representational behavior of these perturbations remain poorly understood. This study provides a systematic, explainable AI analysis using a unified framework that integrates white-box feature-space inspection and black-box signal-level probing. Through latent-space clustering, feature-channel activation analysis, occlusion-based spatial sensitivity mapping, and frequency-domain characterization, we show that protection mechanisms operate as structured, low-entropy perturbations tightly coupled to underlying image content across representational, spatial, and spectral domains. Protected images preserve content-driven feature organization with protection-specific substructure rather than inducing global representational drift. Detectability is governed by interacting effects of perturbation entropy, spatial deployment, and frequency alignment, with sequential protection amplifying detectable structure rather than suppressing it. Frequency-domain analysis shows that Glaze and Nightshade redistribute energy along dominant image-aligned frequency axes rather than introducing diffuse noise. These findings indicate that contemporary image protection operates through structured feature-level deformation rather than semantic dislocation, explaining why protection signals remain visually subtle yet consistently detectable. This work advances the interpretability of adversarial image protection and informs the design of future defenses and detection strategies for generative AI systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
