Proactive image protection methods aim to defend visual content against unauthorized manipulation and generative misuse by embedding protective signals into images before release. Evaluating whether these protections remain effective under image editing is therefore critical. However, existing evaluations remain largely limited to one-shot edits, providing only a static view of robustness while overlooking its evolution under realistic multi-step editing workflows. To systematically characterize robustness dynamics under sequential editing across various protection paradigms, we introduce PREEMPT, a holistic evaluation framework. It evaluates protection robustness under both one-shot and sequential editing scenarios, covering image transformations, semantic edits, homogeneous and heterogeneous edit compositions. To enable consistent analysis across protection paradigms with different underlying objectives, PREEMPT normalizes task-specific effectiveness into protection survival trajectories and summarizes long-horizon robustness through trajectory-based diagnostics. Using this framework, we reveal that degradation behaviors remain hidden under conventional one-shot evaluation. Furthermore, perturbation- and watermark-based protection methods exhibit different failure modes, and the first semantic edit largely determines subsequent degradation trajectories. PREEMPT provides a standardized protocol for studying long-horizon robustness and offers new insights into the degradation dynamics of proactive image protection.
Figures & tables
Figure 1: Overview of PREEMPT. Our framework evaluates proactive image protection methods under both one-shot and sequential editing scenarios. One-shot evaluation includes image-transformation-based edits and semantic edits, while sequential evaluation considers both homogeneous and heterogeneous edit chains to simulate realistic multi-step manipulations.
Figure 2: Representative heterogeneous editing trajectories. Rows correspond to faces, artworks, and objects. Each trajectory consists of alternating transformation-based and semantic edits, illustrating the mixed editing workflow used in our sequential robustness evaluation.
Method
No edit
JPEG 70
JPEG 50
Bright. & Contr.
Blur
Crop
Flip
Avg.
None
1.000
0.988
0.975
0.976
0.971
0.940
0.966
0.969
AdvDM
0.872
0.874
0.872
0.869
0.880
0.824
0.858
0.863
MIST
0.901
0.895
0.889
0.890
0.881
0.855
0.884
0.882
PhotoGuard
0.900
0.895
0.890
0.890
0.880
0.856
0.885
0.883
SDST
0.909
0.899
0.896
0.896
0.884
0.865
0.890
0.888
Table 1: Effectiveness of perturbation protection methods under one-shot image transformation. Metric: semantic similarity ( ↓ ).
Method
No edit
JPEG 70
JPEG 50
Bright. & Contr.
Blur
Crop
Flip
Avg.
Robust-Wide
1.000
1.000
1.000
0.987
1.000
0.539
0.452
0.830
TrustMark
1.000
0.999
0.998
0.982
1.000
1.000
0.999
0.996
VINE
1.000
1.000
1.000
0.998
0.999
0.504
0.465
0.828
WAM
1.000
0.998
0.994
1.000
1.000
1.000
1.000
0.999
Table 2: Effectiveness of watermarking methods under one-shot image transformations. Metric: message retrieval accuracy ( ↑ ).
Method
No edit
Content
Attribute
Style
Spatial
Avg.
None
1.000
0.760
0.720
0.740
0.695
0.729
AdvDM
0.872
0.267
0.234
0.331
0.249
0.270
MIST
0.901
0.505
0.384
0.495
0.492
0.469
PhotoGuard
0.900
0.490
0.372
0.486
0.462
0.453
SDST
0.909
0.458
0.376
0.508
0.495
0.459
Table 3: Protection effectiveness of perturbation-based methods under one-shot semantic edits. Metric: semantic similarity ( ↓ ).
Method
No edit
Content
Attribute
Style
Spatial
Average
Robust-Wide
1.000
0.990
0.970
0.950
0.975
0.971
TrustMark
1.000
0.899
0.866
0.859
0.852
0.869
VINE
1.000
0.945
0.899
0.850
0.917
0.903
WAM
1.000
0.894
0.805
0.733
0.837
0.817
Table 4: Protection effectiveness of watermarking methods under one-shot semantic edits. Metric: message retrieval accuracy ( ↑ ).
Figure 3: Protection survival curves under homogeneous semantic chains (left) and heterogeneous mixed chains (right). Robustness evolves progressively with editing depth rather than remaining a static endpoint. The x-axis denotes the editing depth ( D=4 ), and the y-axis shows the normalized Protection Survival Ratio (PSR). Solid lines indicate perturbation-based methods, and dashed lines indicate watermark-based methods. The legend reports each method together with its pre-edit effectiveness, S(0) .
Figure 4: Protection survival curves aggregated by protection paradigms. Shaded regions indicate the standard deviation across methods within each protection paradigm. Perturbation- and watermark-based methods exhibit distinct robustness evolution patterns under sequential editing.
Figure 5: Average rank change from one-shot ( d=1 ) to long-horizon ( d=4 ) evaluation under homogeneous and heterogeneous edit chains. Positive (negative) values indicate worse (better) rankings after sequential editing, showing that one-shot rankings are not consistently preserved.
Figure 6: Robustness trajectories under heterogeneous edit chains grouped by the type of the first edit. (a) Physical-first trajectories remain largely unchanged until the first semantic edit occurs. (b) Semantic-first trajectories exhibit an immediate robustness transition followed by slower evolution. Shaded regions denote the standard deviation across perturbation-based methods.
Method
Homo. α
Hetero. α
PhotoGuard
0.65
0.45
MIST
0.63
0.45
AdvDM
0.93
0.52
SDST
0.69
0.44
Table 5: Contribution of the first editing step to the overall robustness evolution. Higher α indicates that a larger proportion of robustness change occurs immediately after the first edit.