Image editors built on diffusion transformers (DiTs), such as Flux Kontext, make it possible to turn a single photograph into a convincing manipulated image, including harmful and non-consensual edits. Proactive defenses aim to prevent such manipulations by adding an imperceptible perturbation before an image is shared. Existing defenses for DiT-based in-context editors make the output attend less to the protected reference image. But this leaves the model free to follow the edit instruction using the text and its own generated tokens, often producing a new, weakly grounded image rather than preventing the edit. We find that the opposite strategy is more effective: instead of leading the model to ignore the reference, we encourage it to copy it. Through controlled attention interventions, we show that concentrating target-token attention on the reference image in only a few early blocks is sufficient to collapse the editing behavior, causing the model to reproduce its input, often as a lossy copy, rather than execute the requested transformation. Based on this insight, we introduce Copying-as-Defense (CaD), which maximizes per-token target-to-reference attention mass in early transformer blocks. Since attention rows are normalized, increasing reference attention suppresses the attention allocated to the text and generated canvas. Restricting the objective to early blocks also lets us truncate the backpropagation path, keeping optimization cheap. Across editors and benchmarks, CaD reduces average edit success from 81.4% on unprotected images to 24.0%, a 70.6% relative reduction, and by a further 44.3% relative to DeContext, the strongest baseline (43.0%). CaD is also roughly 1.8-2.0x faster per optimization step than comparable methods.
Figures & tables
Figure 1: Reference suppression is less reliable when the protected subject occupies fewer image tokens. We overlay the Flux Kontext image-token grid on the protected inputs. Orange outlines mark majority-subject tokens and the blue box marks face tokens. Suppression disrupts the face-centric edits in (a), while both requested edits remain successful on the full-body subject in (b).
Figure 2: Increasing target-to-reference attention induces copying, whereas suppressing it does not prevent editing. We intervene cumulatively over increasingly deep prefixes of Flux Kontext’s early double-stream blocks. Target → Ref =0 removes reference attention, while Target → Ref =1 places all target-query attention on reference keys. (a) Suppression still permits instruction-consistent generation, whereas maximizing reference attention increasingly reproduces the natural or black reference. (b) On 10 BodyBench images, PickScore remains high and nearly flat for no intervention and Target → Ref =0 , but drops under Target → Ref =1 as more blocks are intervened on.
Edit Metrics
Identity
Image Metrics
Runtime
Editor
Dataset
Method
PickScore ↓
CLIP dir ↓
Edit Succ. ↓
ArcFace ↓
LPIPS ↓
PSNR ↑
TS↓
TP↓
FIBO
InpaintGuard Bench
Unprotected
20.68
0.2428
0.800
0.9438
–
–
–
–
PhotoGuard
20.58
0.2112
0.823
0.7870
0.1497
29.77
0.057
0.76
DeContext
20.46
0.1971
0.597
0.7258
0.3599
29.48
1.385
18.47
Diff-PGD
19.89
0.1751
0.527
0.7881
0.3240
30.22
1.531
20.41
Ours
19.56
0.1193
0.183
0.1627
0.3070
28.76
0.754
12.57
Table 1: Protection performance across datasets and image editing models for ϵ=12/255 . Blue bold indicates the best result and light blue indicates the second-best result. Runtime is measured per optimization step; total protection time uses 800 steps for the baselines and 1000 steps for ours.
Figure 3: Qualitative comparison across editors and datasets. We show FLUX Kontext on BodyBench (top) and FIBO Edit on InpaintGuardBench (bottom), with all protections using ϵ=12/255 . Existing defenses fail to prevent the edit, while our method prevents the requested transformation.
Figure 4: Protection remains strong across perturbation budgets. Edit success versus LPIPS for FLUX Kontext at ϵ∈{4,8,12,16}/255 . Lower is better on both axes. Across budgets, our method achieves substantially lower edit success than the baselines at comparable LPIPS.
Figure 5: CaD reaches strong protection within the first few hundred optimization steps. Protection metrics on BodyBench with FLUX Kontext at ϵ=12/255 . Lower is better for all metrics.
Figure 6: Early double-stream blocks are sufficient for strong protection. Each point x applies our objective cumulatively to blocks 0 through x on BodyBench. Lower is better on both axes.
Modern image editors combine vision-language models (VLMs) with diffusion transformer backbones to modify a single reference image according to instructions without fine-tuning. This capability also enables unauthorized manipulation of publicly released images. Existing inference-time defenses either invalidate edits through conspicuous corruption, thereby exposing the protection, or allow them to proceed with identity or reference content drift, thereby failing to prevent the editing behavior itself. We instead target a stealthy and harmless no-op in which the requested edit is suppressed, the output remains natural and source-preserving without conspicuous artifacts or identity replacement, and harmful semantics requested by malicious instructions are absent. We propose NullEdit, which targets the VLM representation jointly formed from the reference image and instruction before it conditions the downstream DiT backbone. Using normal-edit and no-edit anchors, NullEdit redirects this representation, while cross-prompt gradient averaging transfers protection to held out instructions. Across Step1X-Edit and Qwen-Image-Edit on CelebA-HQ and VGGFace2, NullEdit reduces the EditReward IF score by 0.813 on average relative to the SOTA baseline while preserving subject identity and source content.
Weiyao Huang, Liqin Wang, Ziqi Sheng +1
School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China
The rise of powerful, accessible image-editing models such as FLUX.2 has brought high-fidelity editing within broad reach. Their capabilities now extend beyond localized modifications to extracting and recontextualizing objects and identities in entirely new scenes. By allowing prompt and generation tokens to attend directly to reference-image tokens, modern models blur the boundary between conventional editing and text-to-image synthesis. This expanded generative freedom also broadens the space of potential misuse, as harmful transformations are no longer confined to a predictable set of localized edits. Existing anti-edit defenses are designed to disrupt the semantic bottleneck of the reference-image encoding in legacy diffusion pipelines. However, newer editors distill reference information through joint-attention blocks, thereby often circumventing these protections. We therefore introduce VETO, a subtle anti-edit cloak that disrupts this inner mechanism through which modern models read the source image. Additionally, as existing editing benchmarks leave comprehensive recontextualizations largely untested, we introduce VetoBench, which evaluates defenses not only on conventional localized edits but also on broader contextual shifts. Across two contemporary editing models and three benchmarks, VETO consistently outperforms existing defenses while providing a stronger protection-fidelity trade-off.
Jonas Grebe, Hossein Shakibania, Tobias Braun +2
TU Darmstadt & hessian.AI, Germany · Zuse School ELIZA
Diffusion models enable high-fidelity image editing but can also be misused for unauthorized style imitation and harmful content generation. To mitigate these risks, proactive image protection methods embed small, often imperceptible adversarial perturbations into images before sharing to disrupt downstream editing or fine-tuning. However, in realistic post-release scenarios, content owners cannot control downstream processing pipelines, and protections optimized for a surrogate model may fail when attackers use mismatched diffusion pipelines. Existing purification methods can weaken protections but often sacrifice image quality and rarely examine architectural mismatch. We introduce a unified post-release purification framework to evaluate protection survivability under model mismatch. We propose two practical purifiers: VAE-Trans, which corrects protected images via latent-space projection, and EditorClean, which performs instruction-guided reconstruction with a Diffusion Transformer to exploit architectural heterogeneity. Both operate without access to protected images or defense internals. Across 2,100 editing tasks and six representative protection methods, EditorClean consistently restores editability. Compared to protected inputs, it improves PSNR by 3-6 dB and reduces FID by 50-70 percent on downstream edits, while outperforming prior purification baselines by about 2 dB PSNR and 30 percent lower FID. Our results reveal a purify-once, edit-freely failure mode: once purification succeeds, the protective signal is largely removed, enabling unrestricted editing. This highlights the need to evaluate protections under model mismatch and design defenses robust to heterogeneous attackers.
Qichen Zhao, Shengfang Zhai, Xinjian Bai +4
Peking University · National University of Singapore · The University of Western Australia