Diffusion models enable high-fidelity image editing but can also be misused for unauthorized style imitation and harmful content generation. To mitigate these risks, proactive image protection methods embed small, often imperceptible adversarial perturbations into images before sharing to disrupt downstream editing or fine-tuning. However, in realistic post-release scenarios, content owners cannot control downstream processing pipelines, and protections optimized for a surrogate model may fail when attackers use mismatched diffusion pipelines. Existing purification methods can weaken protections but often sacrifice image quality and rarely examine architectural mismatch. We introduce a unified post-release purification framework to evaluate protection survivability under model mismatch. We propose two practical purifiers: VAE-Trans, which corrects protected images via latent-space projection, and EditorClean, which performs instruction-guided reconstruction with a Diffusion Transformer to exploit architectural heterogeneity. Both operate without access to protected images or defense internals. Across 2,100 editing tasks and six representative protection methods, EditorClean consistently restores editability. Compared to protected inputs, it improves PSNR by 3-6 dB and reduces FID by 50-70 percent on downstream edits, while outperforming prior purification baselines by about 2 dB PSNR and 30 percent lower FID. Our results reveal a purify-once, edit-freely failure mode: once purification succeeds, the protective signal is largely removed, enabling unrestricted editing. This highlights the need to evaluate protections under model mismatch and design defenses robust to heterogeneous attackers.
Figures & tables
Figure 1: Schematic overview of our post-release purification setting and two purifiers, VAE-Trans (Section 5.1 ) and EditorClean (Section 5.2 ). The Standard image editing pipeline in the figure denotes the defender’s surrogate editor used to optimize the protective perturbation. Left (Training): Both purifiers are trained on public image datasets. Right (Inference): Given xadv , the attacker prepends a purifier to obtain a purified image xpur ; for EditorClean , we additionally inject light Gaussian noise before reconstruction. The purified image is then passed to a downstream editor for editing.
Protection
Purifier
LPIPS ↓
FID ↓
AdvDM
Unpurified
0.458
165.58
JPEG
0.456
160.69
IMPRESS
0.533
234.10
GridPure
0.337
144.03
EditorClean (ours)
0.244
91.29
AdvPaint
Unpurified
0.338
80.49
Table 1: Purified image quality compared to clean images. We report LPIPS ↓ and FID ↓ between purified images and their clean counterparts.
Figure 2: Qualitative comparison of purified image quality across different protection methods and purification strategies (see Table 1 ). Each row shows results for one protection method.
SD v1.5 Inpainting
SD v2.0 Inpainting
Protection
Purifier
PSNR ↑
LPIPS ↓
FID ↓
IR ↑
PSNR ↑
LPIPS ↓
FID ↓
IR ↑
AdvDM
Unpurified
15.70
0.488
60.42
0.031
15.09
0.507
56.13
0.091
JPEG
16.27
0.454
49.82
0.052
15.55
0.475
48.26
0.127
IMPRESS
15.25
0.500
69.17
-0.018
14.83
0.507
62.59
0.075
GridPure
16.41
0.424
41.92
0.022
16.12
0.437
40.73
0.009
VAE-Trans (ours)
16.38
0.438
39.64
0.044
15.90
0.445
37.79
0.133
Table 2: Quantitative comparison of downstream editing results obtained from purified images on SD v1.5 Inpainting (left) and SD v2.0 Inpainting (right, cross-version transfer). All protections are optimized against SD v1.5 only. We report PSNR ↑ , LPIPS ↓ , FID ↓ , and IR ↑ . Best results within each protection are highlighted in bold. The last block reports the effect of applying each purification method to clean images.
Figure 3: Qualitative downstream editing results on SD v1.5 Inpainting (left) and SD v2.0 Inpainting (right). Rows correspond to six protection methods, and columns show edits produced from unpurified protected inputs or from protected inputs after different purification strategies (see Table 2 ).
Method
σ
PSNR ↑
LPIPS ↓
FID ↓
IR ↑
AdvDM
0.05
17.55
0.3648
33.23
0.1127
0.10
18.53
0.3095
24.53
0.1294
0.15
18.43
0.3112
24.57
0.1623
0.20
18.23
0.3222
25.77
0.1527
AdvPaint
0.05
19.36
0.2726
20.04
0.0689
0.10
19.35
0.2696
21.07
0.0535
Table 3: Ablation study on Gaussian noise strength σ before EditorClean purification. We report PSNR ↑ , LPIPS ↓ , FID ↓ , and IR ↑ between edited results of purified protected images and those edited from clean images.
Protection
Purifier
PSNR ↑
LPIPS ↓
FID ↓
AdvDM
Unpurified
17.29
0.384
37.23
JPEG
17.99
0.347
31.31
IMPRESS
16.48
0.419
47.44
GridPure
16.77
0.407
35.83
VAE-Trans (ours)
17.22
0.379
27.46
EditorClean (ours)
19.39
0.266
20.08
Table 4: Ablation study on perturbation budget ϵ . We report downstream editing results on SD v1.5 Inpainting under a smaller ℓ∞ budget ( ϵ=8/255 ), using PSNR ↑ , LPIPS ↓ , and FID ↓ . Best results within each protection are highlighted in bold.
Protection
Purifier
PSNR ↑
LPIPS ↓
FID ↓
CLIP Score ↑
PhotoGuard
Unpurified
20.13
0.3360
117.87
21.28
JPEG
16.85
0.3473
84.60
20.70
GridPure
20.22
0.2841
84.24
21.33
EditorClean (ours)
22.57
0.1992
56.85
20.31
AdvDM
Unpurified
17.81
0.4215
125.50
20.58
JPEG
18.00
0.3174
78.55
20.77
Table 5: Downstream editing results on Step1X-Edit (DiT). Protections are optimized against Step1X-Edit as the surrogate editor. We report PSNR ↑ , LPIPS ↓ , and FID ↓ between Step1X-Edits from protected inputs and Step1X-Edits from clean inputs, and CLIP score ↑ for prompt-image alignment. Best results within each protection are highlighted in bold.
Protection
Purifier
Precision ↑
FID ↓
MIST
Unpurified
0.347
176.08
JPEG
0.479
148.76
GridPure
0.542
143.80
EditorClean
0.613
137.85
PhotoGuard
Unpurified
0.237
200.94
JPEG
0.429
150.44
Table 6: Impact of purification on DreamBooth fine-tuning. Lower FID and higher Precision indicate better generation quality.
Protection
Purifier
CLIP Acc ↑
FID ↓
AdvDM
Unpurified
0.090
517.78
JPEG
0.660
407.70
GridPure
0.937
423.60
EditorClean (ours)
0.997
317.79
MIST
Unpurified
0.007
470.41
JPEG
0.903
360.79
Table 7: Impact of purification on textual inversion style mimicry ( ϵ=8/255 ). We report CLIP Acc ↑ and FID ↓ .
Figure 4: Real-world editor comparison under model mismatch.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Purifier
Clean Acc (%)
Robust Acc (%)
Unpurified
78.5
0.0
DiffPure
64.4
63.2
EditorClean (ours)
69.0
65.6
Appendix
Table 8: Standard accuracy and robust accuracy under AutoAttack ℓ∞ ( ϵ=4/255 ) on ImageNet (ResNet-50), evaluated on 1,024 randomly sampled validation images following the transfer-based protocol of DiffPure.
Figure 5: Extended qualitative examples complementing Figure 4 with a more complex cartoon image and instruction. Rows show clean and protected inputs (six defenses); columns show edited results from Seedream (Doubao), Qwen-Image, Step1X-Edit, Gemini Pro, and ChatGPT-4o.
Figure 6: Qualitative downstream editing results on Step1X-Edit (DiT), corresponding to Table 5 .
Figure 7: Qualitative visualization of the perturbation budget ablation ( ϵ=8/255 ) in Table 4 .
Figure 8: Qualitative visualization of the Gaussian noise strength ablation in Table 3 .
Figure 9: Qualitative DreamBooth fine-tuning results for bear plushie , corresponding to Table 6 .
Figure 10: Qualitative textual inversion style mimicry results for Childe Hassam , corresponding to Table 7 .
Diffusion model advances have enabled powerful text-guided image editing, but also raise ethical and legal risks such as deepfakes and unauthorized use. To prevent these risks, adversarial attack-based image immunization has emerged as a promising defense against AI-driven semantic manipulation. Yet, most existing approaches require image-specific optimization or additional neural networks at inference time, hindering scalability and practicality. In this paper, we propose the first universal adversarial perturbation-based image immunization framework that generates a single, image-agnostic adversarial perturbation specifically designed for diffusion-based editing pipelines. Inspired by UAP used in targeted attacks, our method aims to generate a UAP that induces diffusion models to misinterpret the input image as a specific semantic target. Simultaneously, it suppresses original content to misdirect the model's attention during editing, thereby effectively blocking unauthorized edits by overwriting the image's original semantics via the UAP. Extensive experiments show that our method, as the first universal immunization approach, significantly outperforms several baselines in the UAP setting. Notably, despite the inherent difficulty of universal perturbations, our method achieves competitive or superior performance compared to image-specific methods under a more restricted perturbation budget, while also exhibiting strong black-box transferability across diverse diffusion models.
Modern image editors combine vision-language models (VLMs) with diffusion transformer backbones to modify a single reference image according to instructions without fine-tuning. This capability also enables unauthorized manipulation of publicly released images. Existing inference-time defenses either invalidate edits through conspicuous corruption, thereby exposing the protection, or allow them to proceed with identity or reference content drift, thereby failing to prevent the editing behavior itself. We instead target a stealthy and harmless no-op in which the requested edit is suppressed, the output remains natural and source-preserving without conspicuous artifacts or identity replacement, and harmful semantics requested by malicious instructions are absent. We propose NullEdit, which targets the VLM representation jointly formed from the reference image and instruction before it conditions the downstream DiT backbone. Using normal-edit and no-edit anchors, NullEdit redirects this representation, while cross-prompt gradient averaging transfers protection to held out instructions. Across Step1X-Edit and Qwen-Image-Edit on CelebA-HQ and VGGFace2, NullEdit reduces the EditReward IF score by 0.813 on average relative to the SOTA baseline while preserving subject identity and source content.
Weiyao Huang, Liqin Wang, Ziqi Sheng +1
School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China
The rise of powerful, accessible image-editing models such as FLUX.2 has brought high-fidelity editing within broad reach. Their capabilities now extend beyond localized modifications to extracting and recontextualizing objects and identities in entirely new scenes. By allowing prompt and generation tokens to attend directly to reference-image tokens, modern models blur the boundary between conventional editing and text-to-image synthesis. This expanded generative freedom also broadens the space of potential misuse, as harmful transformations are no longer confined to a predictable set of localized edits. Existing anti-edit defenses are designed to disrupt the semantic bottleneck of the reference-image encoding in legacy diffusion pipelines. However, newer editors distill reference information through joint-attention blocks, thereby often circumventing these protections. We therefore introduce VETO, a subtle anti-edit cloak that disrupts this inner mechanism through which modern models read the source image. Additionally, as existing editing benchmarks leave comprehensive recontextualizations largely untested, we introduce VetoBench, which evaluates defenses not only on conventional localized edits but also on broader contextual shifts. Across two contemporary editing models and three benchmarks, VETO consistently outperforms existing defenses while providing a stronger protection-fidelity trade-off.
Jonas Grebe, Hossein Shakibania, Tobias Braun +2
TU Darmstadt & hessian.AI, Germany · Zuse School ELIZA