保护性扰动在现实世界图像变换下是否真的能保护肖像隐私？
Do Protective Perturbations Really Protect Portrait Privacy under Real-world Image Transformations?
AI总结：
本文评估了现实世界图像变换对基于像素扰动的主动防御方法的影响，发现其有效性受挑战，并提出净化框架以去除保护性扰动。
摘要：
主动防御方法通过引入像素级保护性扰动来保护肖像图像免受未经授权的编辑或谈话面孔生成（TFG）攻击，已引起隐私保护领域的广泛关注。在现实世界场景中，图像在跨设备显示和传播过程中不可避免地经历各种变换，如缩放和颜色压缩，这会直接改变像素值。然而，这种像素级修改是否影响现有依赖像素级扰动的主动防御方法的有效性仍不清楚。为解决此问题，我们系统评估了代表性主动防御方法在图像变换下的表现。评估的方法涵盖了不同生成架构（如扩散模型和GAN模型）以及防御范围（涵盖肖像和自然图像），并使用定性和定量指标进行主观和客观比较。实验结果表明，基于像素级扰动的防御方法难以抵御常见图像变换，这在现实应用中存在防御失效的风险。为进一步突出此风险，我们提出了一种简单但有效的净化框架，利用现实世界图像变换诱导的漏洞。实验结果表明，所提方法能以低计算成本高效去除保护性扰动，凸显了此前被忽视的风险。
英文摘要：
Proactive defense methods protect portrait images from unauthorized editing or talking face generation (TFG) by introducing pixel-level protective perturbations, and have attracted increasing attention for privacy protection. In real-world use, images inevitably undergo sequences of benign operations during display and dissemination, such as resizing and color compression, which directly alter pixel values. Existing studies and robustness defenses mainly examine individual transformations in isolation, while sequentially composed transformations remain underexplored. To address this gap, we systematically evaluate whether representative proactive defenses against unauthorized image editing using GANs and diffusion models, as well as talking face generation, remain effective under sequential image transformations. The evaluated methods span general-purpose and portrait-specific defenses and are assessed qualitatively and quantitatively. Experimental results show that pixel-level perturbation-based defenses struggle to withstand sequences of common image transformations, posing a risk of failure in real-world applications. To further demonstrate that this vulnerability can be exploited at low cost, we introduce Transformation-Induced Purification via Region-wise Super-Resolution (TIP-RSR), a simple training-free framework combining sequential image transformations with off-the-shelf restoration models. TIP-RSR efficiently purifies protective perturbations while preserving image fidelity and requiring substantially less computation than diffusion-based purification methods. These findings expose a practical vulnerability in current proactive portrait defenses and highlight the need to account for sequential real-world transformations when designing future protection mechanisms. Our code is publicly available at https://github.com/Richen7418/TIP-RSR.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
