GeoEdit: Adversarial De-Evidencing for Silent Geoprivacy Protection via Image Editing

Yu Yan; Shengjia Cheng; Fei Ma; Zhe Wang; Peng Chen

cs.CVOct 19, 2026

GeoEdit: Adversarial De-Evidencing for Silent Geoprivacy Protection via Image Editing

Authors: Yu Yan, Shengjia Cheng, Fei Ma, Zhe Wang, Peng Chen

Organizations: People’s Public Security University of China, Beijing, China · Guangming Laboratory, Shenzhen, China

Abstract

Recent efforts have demonstrated the strong capabilities of Multimodal Large Reasoning Models (MLRMs) in geographic reasoning. By jointly analyzing subtle visual cues, these models can infer the locations of photos, thus enabling doxing even by non-expert adversaries. Existing defense methods struggle to balance the shareability of photos with effective protection, and often fail to sufficiently disrupt the implicit geo-evidence chains embedded in scene semantics. To this end, we propose GeoEdit, an adversarial de-evidencing framework for silent geoprivacy protection via image editing. Specifically, we apply minimal edits to high-risk evidence anchors in the image, thereby disrupting the underlying spatial reasoning chains while preserving overall scene semantics. We identify these anchors by combining structured knowledge with adversarially discovered geographic cues. To further navigate the large editing action space, we adopt a learnable policy to iteratively refine editing decisions, distilling successful trajectories into transferable natural-language insights for consistent and efficient editing. Evaluated on LifePhotoBench, GeoEdit achieves strong protection against 6 mainstream MLRMs, outperforming visual perturbation baselines by over 0.59 in image fidelity.

Figures & tables

Panel of Figure 1 — Figure 1. Comparison of social media sharing scenarios. The landmark check-in (a) exemplifies intentional location sharing. Conversely, the daily life photo (b) inadvertently leaks sensitive location data via implicit geo-evidence, resulting in non-consensual exposure and severe doxing risks.

Panel of Figure 2 — Figure 2. Comparison of geoprivacy protection mechanisms. (a) The unprotected image. (b) Image Obfuscation hides sensitive areas but ruins the visual experience. (c) Visual Perturbation tricks visual encoders to protect geoprivacy, but its adversarial nature is often lost during unpredictable image processing and causes noticeable artifacts. (d) Geo-Evidence Editing (Ours) blocks the localization reasoning chain to defend against both MLRMs and human analysis while keeping visual appeal.

Figure 3. Overall architecture of GeoEdit. ❶ De-Evidencing Image Editing: A policy $\pi$ explicitly reasons and acts within a ReAct loop, invoking the core tools $T_{risk}$ , $T_{edit}$ , and $T_{eval}$ to identify evidence, generate semantic edits, and verify protection quality. ❷ Self-Evolution via Insight Distillation: A test-time optimization mechanism that constructs group-relative joint reward signals from rollout trajectories, distilling them into natural-language protection insights ( $\mathcal{K}$ ) to guide future edits.

Evidence Source	Specific Features
Continuous Geo-Features	Similarity Mean, Similarity Variance
Discrete Geo-Features	Scene Complexity, Landmark Level, Text Value
Off-Image Features	Task Attractiveness, Geo-Hint
Image Quality	Weather, Focal Length, View Angle, Clarity

Table 1. The geolocation evidence schema ( Cheng et al., 2026 ) .

Figure 4. Overview of Self-Evolution via Geoprivacy Protection Insight Distillation. By contrasting successful and unsuccessful editing trajectories, GeoEdit distills a group relative advantage into a shared Insight Buffer ( $\mathcal{K}$ ).

Method	Fid. ( $\uparrow$ )	GPT-5.1 Acc@Km ( $\downarrow$ )					Claude-4.5-Sonnet Acc@Km ( $\downarrow$ )					Claude-3.7-Sonnet Acc@Km ( $\downarrow$ )
Method	Fid. ( $\uparrow$ )	1km	25km	200km	750km	2500km	1km	25km	200km	750km	2500km	1km	25km	200km	750km	2500km
Unprotected	1.000	29.6	61.9	71.8	80.3	83.8	26.5	55.4	64.2	77.1	81.5	27.2	56.3	65.8	78.4	82.2
M-Attack	0.344	10.5	23.8	36.2	54.7	76.5	9.2	21.4	33.8	51.7	74.2	11.1	24.8	35.6	53.4	75.7
GeoShield	0.267	3.1	6.8	15.2	31.8	46.2	2.5	5.1	13.8	27.4	49.8	2.8	5.5	14.5	26.3	48.7
Vanilla Edit	0.893	18.3	36.8	49.0	70.0	81.4	16.5	33.2	45.2	66.4	79.8	17.1	34.5	46.8	67.5	80.5
GeoEdit (Ours)	0.944	2.6	5.7	14.9	30.5	53.8	2.1	4.2	13.0	28.6	51.3	2.3	4.8	13.9	29.9	52.5

Table 2. Experiment results of baseline comparisons on geoprivacy protection effectiveness. Geolocation prediction accuracy (%) is reported across different granularities. The best and second-best results are highlighted in bold and underlined, respectively.

Figure 5. Visualization of different protected images. GeoEdit achieves silent protection while preserving naturalness.

Method	Gemini-2.5		GLM-4.6V		Human 1		Human 2
	W-D-L (%)	Cap-Fid $\uparrow$	W-D-L (%)	Cap-Fid $\uparrow$	W-D-L (%)		W-D-L (%)
	W-D-L (%)	Cap-Fid $\uparrow$	W-D-L (%)	Cap-Fid $\uparrow$	Overall	vs. Orig.	Overall	vs. Orig.
Unprotected (original image)	72.0-14.7-13.3	1.000	84.0-0.0-16.0	1.000	76.6-8.0-15.4	0.0-100.0-0.0	83.6-0.9-15.5	0.0-100.0-0.0
M-Attack	25.3- 25.3 -49.4	0.801	45.3 -0.0-54.7	0.865	4.4- 22.8 -72.8	0.0-0.0-100.0	15.6-2.6-81.8	0.0-0.0-100.0
GeoShield	10.7- 16.0 -73.3	0.798	16.0-0.0-84.0	0.849	5.3- 24.8 -69.9	0.0-0.0-100.0	11.0-2.4-86.6	0.0-0.0-100.0
Vanilla Edit	46.5 -3.5-50.0	0.862	33.1-0.0-66.9	0.845	55.0 -13.1-31.9	18.6 - 16.8 -64.6	58.1 - 2.8 -39.1	23.6 -1.6-74.8

Table 3. Results of visual utility evaluation. W-D-L (%) is the percentage of Wins, Draws, and Losses for the images under each corresponding setting in blind pairwise A/B tests. Cap-Fid is MLRM’s caption fidelity of the protected images.

Setting	Fid. $\uparrow$	MDE (km) $\uparrow$
Setting	Fid. $\uparrow$	Gemini-2.5	GLM-4.6V	GPT-5.1	Claude-4.5
GeoEdit	0.944	5240.8	5821.3	3645.9	6836.3
w/o $T_{risk}$	0.915	2453.6	2847.2	1954.8	3158.4
w/o $T_{edit}$	0.931	3582.4	4251.6	2849.5	4526.8
w/o $T_{eval}$	0.898	1627.5	1853.8	1482.2	2084.6
Vanilla Edit	0.893	1354.2	1428.5	1215.6	1583.4

Table 4. Ablation results for GeoEdit on geoprivacy protection effectiveness and fidelity on LifePhotoBench.

Figure 6. Impact of Protection Insight on GeoEdit. We report the average performance of all edited image attempts and corresponding ReAct steps per trajectory at each insight buffer size during self-evolution.

Example	Editing Insight	Detail of Insight
	Subtractive Micro-Feature Removal	For non-landmark scenes, prioritize subtractive micro-feature removal (e.g., erasing botanical markers, scattered debris) over additive effects to avoid creating new regional archetypes.
	Cultural Marker Neutralization	Identify and replace culturally distinctive elements with contextually plausible but globally generic alternatives to create semantic ambiguity while preserving the overall scene narrative.
	Semantic Simplification	Replace distinctive features with neutral, context-appropriate surfaces rather than generating new complex patterns, while maintaining natural weathering and texture noise, specifically optimizing for indoor scenes to maximize ambiguity while preserving naturalness.
	Structural Naturalization	Replace specific man-made structures with generic natural elements via subtle substitution to break database links and hierarchical narratives while maintaining visual plausibility.

Table 5. Interpretability analysis of key protection insights distilled via self-evolution.

Figure 7. Defense Performance (MDE

\uparrow

, km) under DOX-Prompt and DOX-CoT Probing across two MLRMs.

Method	Original	JPEG ( $Q=50$ )	Blur ( $\sigma=10$ )
GeoShield	6836.3	5235.9	7198.0
GeoEdit (Ours)	5240.8	5118.1	5349.8

Table 6. Robustness of GeoEdit under transformations (Geolocation model: Gemini-2.5). Evaluated by Median Distance Error.

Privacy Protection in VLMs

Privacy protection in vision-language models limits sensitive information exposure while preserving useful image understanding and multimodal reasoning.

See all 37 papers

Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models
Sep 18, 2026Yining Wang, Xi Li, Mi Zhang +4Privacy Protection in VLMs Adversarial Attacks on VLMs
Fudan University · East China University of Science and Technology · Shanghai University of Electric Power
GeoCloak: An Agentic Framework for Semantics-Preserving Geolocation Privacy via Peripheral Clue Manipulation
Oct 14, 2026Yixin Wu, Mingjie Li, Yun Shen +2Privacy Protection in VLMs Adversarial Attacks on VLMs
The Hong Kong University of Science and Technology (Guangzhou) · The Hong Kong University of Science and Technology · CISPA Helmholtz Center for Information Security +1
Defending from GeoLocalization through Adversarial Road Trips
Jul 3, 2026Niccolò Niccoli, Federico Becattini, Lorenzo SeidenariAdversarial Attacks Black-Box Adversarial Attacks
University of Florence, Florence, Italy · University of Siena, Siena, Italy

Sep 18, 2026J/K move · Enter open · S save

Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models

Yining Wang, Xi Li, Mi Zhang, Xiaohan Zhang+3

Fudan University · East China University of Science and Technology · Shanghai University of Electric Power

Privacy Protection in VLMs Adversarial Attacks on VLMs

Open paper AskPDF arXiv

Multimodal large reasoning models (MLRMs) have demonstrated remarkable capabilities in complex visual understanding. However, this very power introduces a critical yet underexplored privacy threat: adversaries can exploit MLRMs to precisely infer users' geographic locations from casually shared photographs, by performing structured reasoning over subtle visual cues such as architectural styles, vegetation, and lighting conditions. In this work, we present a systematic study of MLRM-driven geolocation privacy leakage. We first reveal that refusal-based safeguards are critically insufficient, as carefully crafted jailbreak prompts can raise model response rates to 100%. We further identify that existing defenses, which inject imperceptible perturbations into shared images, suffer from structural limitations intrinsic to their pixel-space optimization, resulting in degraded black-box transferability and pronounced visual artifacts. Motivated by these findings, we propose a diffusion-based framework that provides targeted, proactive defense against geolocation privacy leakage. By injecting perturbations into the latent space of a diffusion model during reverse sampling, our method operates directly on high-level semantic representations, thereby resolving the effectiveness-utility bottlenecks by construction. We further ground our optimization with GeoCLIP, a model explicitly aligned with GPS coordinates, as a surrogate to pinpoint and disrupt the geographic signals that MLRMs exploit for location inference. This targeted semantic disruption yields significantly stronger black-box transferability while preserving perceptual image quality, offering a seamless integration on social media platforms. Code is available at https://github.com/RachelWolowitz/Hiding_in_plain_sight.

Abstract

Privacy Protection in VLMs

Explore similar work

Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models

GeoCloak: An Agentic Framework for Semantics-Preserving Geolocation Privacy via Peripheral Clue Manipulation

Defending from GeoLocalization through Adversarial Road Trips