[Paper Review] Raising the Cost of Malicious AI-Powered Image Editing

Hadi Salman, Alaa Khaddaj+3 more|arXiv (Cornell University)|Feb 13, 2023

Adversarial Robustness in Machine Learning15 citations

TL;DR

The paper proposes immunizing images with imperceptible adversarial perturbations to block realistic edits by large diffusion models, and discusses practical policy considerations for deployment.

ABSTRACT

We present an approach to mitigating the risks of malicious image editing posed by large diffusion models. The key idea is to immunize images so as to make them resistant to manipulation by these models. This immunization relies on injection of imperceptible adversarial perturbations designed to disrupt the operation of the targeted diffusion models, forcing them to generate unrealistic images. We provide two methods for crafting such perturbations, and then demonstrate their efficacy. Finally, we discuss a policy component necessary to make our approach fully effective and practical -- one that involves the organizations developing diffusion models, rather than individual users, to implement (and support) the immunization process.

Motivation & Objective

• Motivate raising the economic barrier to malicious AI-powered image editing.
• Propose image immunization as a defense against diffusion-model edits.
• Develop two perturbation-based attacks to disrupt diffusion model manipulation.
• Evaluate the effectiveness of immunization on image generation and editing tasks.
• Discuss techno-policy steps needed for practical deployment.

Proposed method

• Model diffusion and latent diffusion models (LDMs) and their editing capabilities.
• Describe two perturbation strategies: encoder attack and diffusion attack, optimized via projected gradient descent (PGD).
• Formulate encoder attack as minimizing ||E(x+δ) − z_target||^2 under ‖δ‖∞ ≤ ε.
• Formulate diffusion attack as minimizing ||f(x+δ) − x_target||^2 under ‖δ‖∞ ≤ ε, backpropagating through a truncated diffusion process.
• Demonstrate that immunization yields unrealistic edits and reduces prompt-guided image-prompt similarity (via CLIP embeddings).
• Discuss forward-compatibility and policy APIs for model developers to support immunization.

Experimental results

Research questions

• RQ1 Can imperceptible perturbations immunize images against diffusion-model edits?
• RQ2 Do encoder and diffusion attacks differ in effectiveness and robustness?
• RQ3 How does immunization affect edit realism and alignment with textual prompts?
• RQ4 What policy mechanisms are needed to deploy immunization at scale while maintaining model progress?

Key findings

Method	FID ↓	PR ↑	SSIM ↑	PSNR ↑	VIFp ↑	FSIM ↑
Immunization baseline (Random noise)	82.57	1.00	0.75±0.13	19.21±4.00	0.43±0.13	0.83±0.08
Immunization (Encoder attack)	130.6	0.95	0.58±0.11	14.91±2.78	0.30±0.10	0.73±0.08
Immunization (Diffusion attack)	167.6	0.87	0.50±0.09	13.58±2.23	0.24±0.09	0.69±0.06

• Immunized images yield edits that are substantially different from non-immunized edits across several metrics.
• Diffusion-attack immunization produces the strongest degradation of realistic edits compared to encoder-attack and random noise baselines.
• Quantitative metrics show worse FID and lower similarity to prompts for immunized images (e.g., diffusion attack yields FID 167.6, PR 0.87, SSIM 0.50±0.09, PSNR 13.58±2.23, VIFp 0.24±0.09, FSIM 0.69±0.06).
• Image-prompt similarity between generated edits and prompts decreases after diffusion-based immunization, indicating prompts are less effective.
• A baseline of random noise is ineffective at disrupting diffusion-model edits.