arXiv 2512.143412026-03-02cs.CVcs.AIcs.CYcs.LG

面向恶意图像编辑的可迁移防御

Towards Transferable Defense Against Malicious Image Edits

State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences (CAS)（人工智能安全国家重点实验室，计算技术研究所，中国科学院）；University of China Academy of Sciences（中国科学院大学）；School of Computer Science, China University of Geosciences（中国地质大学（武汉）计算机学院）

Jie Zhang, Shuai Dong, Shiguang Shan, Xilin Chen

备注：: 14 pages, 5 figures, accepted by IEEE TPAMI

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

TDAE通过双模优化提升图像对恶意编辑的免疫性，实现跨模型的可迁移防御。

摘要：

近期采用在输入图像中引入不可察觉扰动的方法已显示出在扩散式图像编辑系统中对抗恶意操纵的潜力。然而，现有方法在跨模型评估中存在有限的可迁移性。为此，我们提出了面向恶意图像编辑的可迁移防御（TDAE），一种新的双模框架，通过协调图像-文本优化增强图像对恶意编辑的免疫性。具体而言，在视觉防御层面，我们引入了FlatGrad防御机制（FDM），该机制将梯度正则化纳入对抗目标。通过显式将扰动引导至平坦极小值，FDM增强了对未见编辑模型的免疫鲁棒性。对于文本增强保护，我们提出了一种对抗优化范式，称为动态提示防御（DPD），它周期性地优化文本嵌入，使免疫图像的编辑结果与原始图像的编辑结果对齐，然后在优化嵌入下更新图像。通过迭代对抗更新不同的嵌入，DPD强制生成寻求更广泛免疫增强特征的免疫图像，从而实现跨模型可迁移性。广泛的实验结果表明，我们的TDAE在内模型和跨模型评估中均实现了对抗恶意编辑的最先进性能。

英文摘要：

Recent approaches employing imperceptible perturbations in input images have demonstrated promising potential to counter malicious manipulations in diffusion-based image editing systems. However, existing methods suffer from limited transferability in cross-model evaluations. To address this, we propose Transferable Defense Against Malicious Image Edits (TDAE), a novel bimodal framework that enhances image immunity against malicious edits through coordinated image-text optimization. Specifically, at the visual defense level, we introduce FlatGrad Defense Mechanism (FDM), which incorporates gradient regularization into the adversarial objective. By explicitly steering the perturbations toward flat minima, FDM amplifies immune robustness against unseen editing models. For textual enhancement protection, we propose an adversarial optimization paradigm named Dynamic Prompt Defense (DPD), which periodically refines text embeddings to align the editing outcomes of immunized images with those of the original images, then updates the images under optimized embeddings. Through iterative adversarial updates to diverse embeddings, DPD enforces the generation of immunized images that seek a broader set of immunity-enhancing features, thereby achieving cross-model transferability. Extensive experimental results demonstrate that our TDAE achieves state-of-the-art performance in mitigating malicious edits under both intra- and cross-model evaluations.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。