IMPRESS: Evaluating the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Generative AI

Summary

This paper investigates the reliability of methods for imperceptibly perturbing images to degrade the performance of latent diffusion models for style mimicry or editing. The authors observe that imperceptible perturbations designed to hamper diffusion-based image generation systems often result in perceptible artifacts when the “protected” image is reconstructed with a diffusion model. Noting that unprotected images typically do not exhibit such behavior, the authors propose a “purification” method in which images are optimized with respect to both a consistency objective (such that diffusion reconstruction preserves the purified image) and a similarity objective (such that purification does not perceptibly alter the image). The proposed purification method effectively mitigates two recent imperceptible perturbation methods for image editing and style transfer, indicating that stronger techniques are needed to protect image data from unwanted diffusion-based manipulation.

Strengths

The issue of protecting intellectual property such as images from unauthorized use by the operators of generative models is timely and significant. The proposed purification approach — essentially an image adversarial attack using a simple encoder-decoder consistency objective, projected gradient descent, and Gaussian perturbation initialization — appears straightforward to implement, and is effective in both fine-tuned style mimicry and one-shot image editing scenarios. The authors evaluate their purification method against adaptive perturbations optimized with knowledge of the purification objective and find their method still remains effective The authors include reasonable protection methods (GLAZE, Photoguard) and purification baselines (JPEG compression, Gaussian noise, resizing) in their experiments.

Weaknesses

Figures 1 and 4 are unnecessarily hard to read. For the style mimicking experiments, the labels for each column ("clean image", "protected image", "purified image") misleadingly indicate that the images below are actual clean/protected/purified images from the dataset when in fact they appear to be images generated by a model fine-tuned on either clean, protected, or purified images. For the editing experiment, it would be better to actually show the input clean/protected/purified image in addition to the edited versions. This might require a tweak to the figure format or perhaps separate figures, but I think that more legible figures would better communicate the authors' proposed approach. To justify the choice of tasks on which the proposed method is evaluated, the authors should more clearly indicate that they evaluate against two recent imperceptible protection methods on the specific tasks for which these protections methods were proposed. Otherwise, the choice of task (e.g. background editing) could come off as arbitrary. The size of the experiment datasets are not stated (e.g. for style mimicry, the number of images per artist is given, but not the number of artists). The total number of samples evaluated should be given for both experiments. Adaptive protection results are shown only for style mimicry, not editing. The authors do not appear to discuss the runtime / computational complexity of their purification method. In apparent contradiction with the authors' response to the NeurIPS checklist, compute details appear to be missing from the paper and appendix. For the experiments section, the image examples are currently more compelling than the metrics. For the image editing task, it is not clear from Table 2 how much "better" the purified images fare than protected images -- e.g., how significant is a PSNR value of 15 vs. 14? Is there a value below which an attempted edit can be considered a failure? Without context, it is hard to get a sense of the effectiveness of the proposed approach. The classifier metrics for the style mimicry experiment are clearer, but still do not take into account many aspects of generated image quality (e.g. adherence to the prompt beyond style). A human subjects study assessing the quality and "correctness" of images generated in each task for the clean/protected/purified conditions would be much more persuasive. The evaluation tasks appear to involve image models that operate under different "control" paradigms -- fine-tuning and text-prompting in the case of style mimicry, and one-shot image-conditioning and text-prompting in the case of background editing. This difference seems significant in that in the former case, purification must mitigate the influence of protective perturbations on the training process while in the latter case, purification must only mitigate the influence of protective perturbations on a forward pass through the diffusion model. I think this distinction between experimental tasks should be emphasized because (a) it is not immediately clear in the paper, and (b) because it is possible this could be framed as a strength of the proposed method (i.e. operating in distinct tasks/settings).

Questions

It is interesting that the simple consistency objective is sufficient to defeat protective perturbations, especially when optimized only with knowledge of the image encoder and decoder. Does this result imply that existing protection approaches primarily leverage the image encoder and decoder rather than the latent diffusion model itself? It would also be interesting to see whether there are other efficient ways to approximately optimize through the latent diffusion process. (The following is more of a thought / comment than a question). In the adversarial example literature, methods have been proposed to tackle optimization with respect to competing objectives (e.g. perturbation effectiveness and imperceptibility). Often, one objective dominates the optimization even when loss values are scaled with well-chosen weights, leading to poor results and inaccurate estimates of robustness. The method of Bryniarski et al. [1] seems to be effective in allowing adaptive adversaries to better balance multiple constraints. Such an approach might lead to more effective balancing of the similarity and consistency objectives not just for the IMPRESS purification method, but for an adaptive adversary like the one proposed in section 5.4 of the paper. I think the simple projected gradient descent method and loss formulation the authors propose in this paper is fine -- it shows the effectiveness of the core idea without the need for extensive tweaks -- but it would also be interesting to see future work incorporate more recent techniques from adversarial machine learning into the protection and purification methods. [1] Bryniarski, Oliver and Hingun, Nabeel and Pachuca, Pedro and Wang, Vincent and Carlini, Nicholas. "Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent." ICLR 2022.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Yes.

Summary

This paper proposes IMPRESS, a new purification method to remove imperceptible perturbations that are claimed to be able to prevent unauthorized data usage in diffusion-based image generation. Specifically, IMPRESS aims to produce a purified version of the perturbed image by minimizing the distance between the perturbed image and its reconstructed image as well as the distance between the perturbed image and the purified image. The authors also consider a challenging scenario where protection can be adapted to IMPRESS.

Strengths

- Very good writing and thorough review of related work - Clear motivation, especially for the elegant design of the consistency loss - Sufficient descriptions of technical details of IMPRESS and the experimental settings - Two SOTA protection methods in two tasks are considered.

Weaknesses

- Limited comparison to (potential) baselines. 1) First of all, as acknowledged by the authors in Section 5.3, previous work (Salman et al. and Sandoval-Segura et al., 2023) has already identified the effectiveness of JPEG compression in solving the studied problem. Therefore, it should be explicitly stated in the Introduction that this paper is not the first to study whether “Imperceptible Perturbations Really Prevent Unauthorized Data Usage”. One specific question: What does it mean by “compression rate as 15%”? Is the quality factor 15% (stronger compression) or 85%? This is important because Sandoval-Segura et al. 2023 have found that choosing strong compression is the key to purifying the perturbations. 2) In addition, the countermeasures that are considered in the original papers of GLAZE and PhotoGuard should also be compared. This is necessary because this paper considers two different metrics (i.e., style classification scores) for measuring the effectiveness of IMPRESS. It is not clear whether those originally considered countermeasures can already achieve very good results in these two metrics. 3) Other popular purification methods should also be tested. For example, existing work has shown that diffusion-based purifications are very effective in removing adversarial perturbations. Such methods should be definitely compared. - Limited explorations of adaptive attacks. Table 3 demonstrates that adaptive attacks show similar results and even worse results than non-adaptive attacks. This is surprising since additional knowledge is incorporated, and it also gives a sign that the adaptive attack may not be properly designed. The authors should either consider better designs or explain why this weird phenomenon happens. Typos: Line 232: should be some grammatical mistake for “setting reproduced the code” Line 309: whether is possible -> whether it is possible

Questions

See weaknesses

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

I do not find anywhere discussing Broader Impacts and Limitations, although the authors check "yes".

Summary

This work is focused on testing the vulnerability of approaches that prevent unauthorized data usage in diffusion models. The paper shows that existing approaches for this problem are fragile, and leads to difference b/w original and diffusion reconstructed image. Then, based on the previous observation the paper proposes a method named IMPRESS to purify the modified images based on a consistency loss. The results show that the proposed approach can successfully purify the imperceptible modifications on two existing approaches, GLAZE and PhotoGuard. Lastly, the work shows that an adaptive variant of GLAZE, that takes into account the proposed consistency loss still can't defend against IMPRESS.

Strengths

1. The writing quality of the paper is satisfactory. The main approach is easy to follow, and important preliminaries are clearly explained. 2. The results show that the proposed approach can surpass simple baselines. Both PhotoGuard, and GLAZE function as a form of adversarial attack, and thus should be vulnerable to similar transformations such as JPEG Compression, and geometric transformations. The work considers these as baselines and shows for GLAZE the proposed approach works better. For PhotoGuard, all baselines perform equivalently and are able to purify the protected image.

Weaknesses

1. The overall contribution of this work may not be significant. The work relies on solving an expensive optimization problem and shows that imperceptible perturbation cannot prevent unauthorized data usage. However, it also shows that simple preprocessing approaches such as JPEG, and Resizing are effective against PhotoGuard. A similar observation was already made by [1]. The results on GLAZE show better performance, but the work doesn't consider more optimized baselines such as what happens for different JPEG compression ratios, or JPEG + Resizing + other geometric transforms. 2. The computational complexity of recovering the purified image is not discussed, especially w.r.t baselines. How long does the proposed approach take? JPEG and Resizing are fairly inexpensive operations compared to the proposed approach that relies on solving an optimization problem. [1] Sandoval-Segura, Pedro, Jonas Geiping, and Tom Goldstein. "JPEG Compressed Images Can Bypass Protections Against AI Editing." _arXiv preprint arXiv:2304.02234_ (2023).

Questions

1. The approximation of consistency loss from the diffusion model to the encoder-decoder is unintuitive. Does this imply the IMPRESS approach is independent of the diffusion model? 2. Related to the above, how would the IMPRESS approach work for a non-latent diffusion model?

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

See the weaknesses above.

Summary

In this work, the authors showed some intellectual protection methods for diffusion methods via imperceptible perturbations could be removed, hence questing the effectiveness of such methods. The authors observed perceptible inconsistency between the pair of original samples and the reconstructed ones by diffusion models, and then proposed IMPRESS method to disable these imperceptible perturbations. In the experiments, the authors tried to break two image protection methods, namely GLAZE and Photoguard, and showed their advantage over some known post-processing methods.

Strengths

1). This work studies an interesting problem that questions the real effectiveness of the existing image protection methods. 2). The empirical observation between the differences of protected images and reconstructed images seem appealing. 3). The paper presents well and is easy to follow.

Weaknesses

1). The two terms in the proposed loss (in Eq.4.1) are common denoising operators and are straightforward to come up with. This may hinder the technical novelty of this work. 2). There have been many denoising methods in the computer vision community, either deep learning based or conventional methods. Could these methods be modified as a proxy of the proposed method? 3). This paper lacks baseline methods. Why not compare with advanced denoising methods? 4). Though the methods to break are based on imperceptible perturbations, there can also be perceptible ones, please discuss whether your method can deal with such perturbations.

Questions

See Weakness.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

NA.

Summary

Diffusion-based image generation models, such as Stable Diffusion or DALLE2, are able to learn from given images and generate high-quality samples following the guidance from prompts. However, such ability also brings unauthorized data usage problem. In response, several attempts have been made to protect the original images from this problem by adding imperceptible perturbations. The author discovered that it is possible to render these methods ineffective by purifying the image and disabling the added perturbation. They conduct experiments for style mimicking and malicious editing tasks to comprehensively evaluate the risks of using imperceptible perturbations.

Strengths

1. This paper identifies a common drawback in existing data protection methods by adding imperceptive perturbations. 2. The method proposed by the authors is straightforward in its implementation but yields impressive results.

Weaknesses

1. The method proposed in this article is based on empirical findings and lacks profound theoretical support, which is slightly incongruent with the theme of the NeurIPS conference. 2. This work has limited novelty because this approach is commonly used in the detection and removal of adversarial examples. 3. The experimental results exhibited in the article have limited scope and quantity, which makes it difficult to provide strong support for the effectiveness of the method.

Questions

1. Why the adaptive image protection with consistency-based losses in section 5.4 does not really bring true protection? What is the underlying reason behind it? 2. How effective is the proposed method attacking against other methods which protect the original images from style mimicking or malicious editing? 3. How do you solve the optimization problem in Eq.(4.1)? Is it through deep learning methods or mathematical methods, please provide some more details about the algorithm. --------------------------------- I read the rebuttal and the questions are answered. My main concern is the novelty of the methodology.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

It is recommended that the authors explain the limitations of the proposed method, such as potential negative social impact (i.e., someone may do malicious editing of images by using your approach), limited applicable scenarios and so on.

Raised score

I thank the authors for providing the rebuttal, which contains a lot of new results that well address my concerns.

Raising Score

I thank the authors for the response and additional baselines. While the computational complexity of the proposed approach is high, compared to other baselines, the results show that the proposed approach works better (specifically for Style Mimicking). I've raised my score accordingly.

Response to rebuttal

I thank the authors for their detailed comments, and for performing additional experiments to address the concerns raised in my review. I think the rebuttal makes a strong case that the proposed method (a) is more effective than simple editing baselines and (b) at worst, operates at around the same computational complexity as the protection methods it counteracts. I appreciate the additional experiments for adaptive adversaries, including O-PGD, and agree with the authors that the lack of success there may be due to the difficulty of balancing the objectives. I think that incorporating the results and clarifications from the rebuttal, in addition to the modifications promised by the authors, will greatly strengthen the paper. Overall, I think the fact that (increasingly popular) image protection methods can be defeated with a straightforward adversarial attack -- and that corresponding adaptive methods do not easily defeat this attack -- is an interesting and important result. I have updated my score in response to the rebuttal.