We thank the reviewer for their time and comments. We address the weaknesses as follow:
> The study heavily relies on MTurk workers, who may not be suitable for this task. They might lack the expertise to classify artistic styles or assess whether artwork quality has been degraded. Artists themselves, such as those mentioned in [1], should be included in the main evaluation.
We disagree with the fact that MTurk annotators are not suitable for this task. We have several baseline experiments that provide results similar to those obtained by the Glaze user study with artists (see Appendix K). Also, we train our annotators and filter them with strict quality questions that less than 20% of annotators passed. Appendix K includes all details on the design.
> Additionally, these workers may not represent potential consumers of artists' works, contrary to what the authors propose (L 338). A more thorough study should report the workers' relevance to the art domain (e.g., how often they purchase art or visit museums).
Studying consumer behavior is outside the scope of our work. As we detail above, we have carefully designed our human study to match baselines in the original Glaze work (where they used artists as judges), and believe they serve as a good evaluation for how humans perceive AI-generated art.
> The effectiveness of the fine-tuning procedure is unclear. As shown in Fig. 3 (especially the bottom row) and Fig. 5, the generated images, even without protection, do not closely resemble the style of the training images. In contrast, previous work like Glaze [1] uses a fine-tuning setting with much stronger resemblance between generated images and training data (see Fig. 2 in [1]).
We disagree with this assessment. In Appendix D, we compare our fine-tuning setting against the fine-tuning setting used in Glaze. Our results may even indicate improved performance with our fine-tuning setting, but in any case we believe the two are definitely comparable. The cross-paper figure comparison suggested by the reviewer features completely different styles, and is thus not suited to judge the fine-tuning settings.
> The focus should be on whether adversarial perturbations effectively defend against mimicry once it has been successfully achieved. Even in Appendix K, where the limitations of using MTurk for evaluation are acknowledged, fewer than 50% of cases were rated as better or equal to “successful” mimicry.
This is incorrect: Appendix K shows that the majority, i.e. more than 50% of cases were rated as “successful” or “very successful” mimicry. In addition, less than a quarter of cases were rated as “not very successful” or “not successful at all”.
> Even if the above weaknesses are overlooked, the paper provides no new insights on solving the problem of mimicry. Both pre-processing and adversarial perturbations degrade image quality, raising the question of whether removing adversarial perturbations is worth the cost, given that pre-processing might degrade the image quality in ways that hinder style recognition.
Our study provides the crucial insight that, in the eyes of humans, current mimicry protections can be (nearly) completely disabled.
> The paper overlooks broader ethical implications, such as the removal of adversarial perturbations used as a watermark. Similar to traditional watermarks (such as a simple icon on the corner) that can be removed but are illegal to do so in many countries, stronger watermarks complicate removal and leave evidence. A discussion on these ethical issues would contribute more meaningfully to the community.
As ML researchers, our work is to inform that protections are not effective in all cases. Our findings might inform new laws or policies by clarifying what a technology can (or cannot) do, but these discussions are ultimately outside the realm of science.
> The proposed methods lack novelty, largely offering improved hyper-parameter tuning of existing approaches.
We emphasize that most methods we implement already existed before the protections themselves were released. We demonstrate that original evaluations were incomplete and that previous methods could bypass protections. The novelty of our work is quantifying this effect for the first time via a human study. In addition, we are the first to evaluate the highly effective Noisy Upscaling as a technique for purification.