Thanks for your feedback. We hope we can further address your concerns and engage in constructive discussions.
Thank you for your valuable reply. We are glad to address the additional questions you've raised, and we hope our responses will further address your concerns and facilitate constructive discussions on the future work of PAP.
> Q1: If the variance is smaller (0.1, 0.5) could yield improved performance.
Firstly, within the tested variance range (1, 5, 10, 20), the performance trend is indeed a slight initial rise (from 1 to 5) followed by a decline (from 5 to 20). Additionally, to better address your concern, we have supplemented **Table R7** with control experiments using variances of 0.1 and 0.5 as you mentioned.
**Table R7**: Simple Baseline of Adding Gaussian Noise
| Variance | LPIPS(↑) | FDFR(↑) | ISM(↓) | BRISQUE(↑) |
|----|-----|------|---------|------|
| 0.1 | 0.66 | 0.62 | 0.41 | 30.98|
| 0.5 | 0.66 | 0.63 | 0.39 | 31.74|
| H | 0.70 | 0.67 | 0.34 | 35.02|
> Q2: Incorporate PAP could make the protection even more sensitive to the initial prompt.
Regarding the quality in **Table R5** being slightly lower than the Clean version, we note that these results used the same setup as described in the paper: 20 gradient descent steps starting from "" to obtain $c_N$. We plan to adapt our approach by dynamically tuning the learning rate and stepsize. Moreover, instead of using an empty string, further experiments are needed to identify a generic $c_0$ and optimization settings, thereby eliminating the need to manually select prompts for different tasks.
> Q3: How does the PAP algorithm adapt to handle variable-length prompts?
Currently, for SD2.x, our approach is to pad all prompts to a fixed length of 77 tokens for processing, consistent with our approach for SD1.x. Although this may not be the optimal solution, we adopted this strategy for the following reasons:
1. Prompt Length Sufficiency: In general, a length of 77 tokens is adequate to accommodate most prompts, as they rarely exceed this limit in practical applications.
2. Optimization Landscape Smoothness: Maintaining a consistent prompt length ensures a smoother optimization landscape, which is advantageous for solving the optimization problem effectively.
Despite this approach's potential limitations, the results in **Figure R1** from the rebuttal.pdf demonstrate that our method still achieves satisfactory performance.
> Additional comments1: Incorporating more encoders into the protection mechanism
While the paper considers attacks using the VAE encoder, which is one of the most popular and widely used image encoders in SD, other encoders are worth considering for integration into the attack process. This could help enhance the generalizability of the proposed method.
To this end, in our future work, we will further design attack strategies for image encoder-agnostic scenarios. Specifically, we will consider several of the most commonly used image encoders, and by integrating these encoders with our modeling of image feature distributions, we will sample and attack the feature distributions of images across various encoders. This will be further
fused with our original PAP approach in the future.
We anticipate that the above proposed **Prompt & Encoder-Agnostic Perturbation (PEAP)** method will be robust against various attack prompts and image encoders, aligning with our pursuit of image protection that better reflects real-world scenarios.
> Additional comments2: Continue working on and improving the method, as new personalization techniques and new models emerge
Thank you for your encouragement. We are aware of the rapid development in the field of customized generation, such as the InstantX series. We will continue to enhance PAP by experimenting with new personalization techniques and models, while also striving to improve the attack efficiency and reduce the computational cost of PAP.
Finally, we sincerely appreciate your suggestions and encouragement for our work. We welcome further discussions on the ideas mentioned, and we are deeply grateful for your willingness to increase your score.