Research map / Image generation / Text-to-image diffusion
VA3: Virtually Assured Amplification Attack on Probabilistic Copyright Protection for Text-to-Image Generative Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes VA3, an online attack that repeatedly queries a text-to-image model protected by NAF/CP-k copyright protection, using bandit-based prompt selection and an Anti-NAF adversarial prompt optimization to amplify infringement probability.
Problem
Probabilistic copyright protection (near-access-freeness, CP-k) for text-to-image diffusion models only bounds per-generation infringement probability, but persistent adversarial interaction may amplify infringement across many queries.
Approach
Model the attacker as an adaptive prompt generator over repeated interactions, with a theorem showing success probability approaches 1 given a positive per-attempt success lower bound; combine epsilon-greedy bandit prompt selection with Anti-NAF, a white-box embedding-optimization method that minimizes the NAF divergence to a copyrighted target while keeping target likelihood high.
Key results
- With amplification, Anti-NAF reaches 99.84% CIR and 77.36% FAR@5%AR on POKEMON, versus 12.88% CIR and 8.52% FAR@5%AR without amplification.
- On LAION-mi, Anti-NAF with amplification achieves 73.32% FAR@15%AR (vs 4.16% without amplification at the same AR).
- FAR-AR curves show performance rising rapidly with more amplification steps, and bandit variants reduce variance across target images.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply amplification to Anti-NAF prompts (ablation) | Anti-NAF on POKEMON · POKEMON | FAR@5%AR: 8.52% -> 77.36% | Helped |
| Apply amplification to Anti-NAF prompts (ablation) | Anti-NAF on LAION-mi · LAION-mi | FAR@50%AR: 7.00% -> 95.92% | Helped |
| Use Anti-NAF rather than CLIP-Int. with amplification | Protected model on POKEMON · POKEMON | FAR@5%AR: 22.84% -> 77.36% | Helped |
| Use Anti-NAF rather than PEZ with amplification | Protected model on LAION-mi · LAION-mi | FAR@30%AR: 50.68% -> 73.32% | Helped |
| Add loss clipping ' to the Anti-NAF objective (ablation) | Anti-NAF on POKEMON · POKEMON | FAR@5%AR: 1.36% -> 8.52% | Helped |
| Include Lq and loss clipping rather than optimizing Lp only (ablation) | Anti-NAF on POKEMON · POKEMON | FAR@15%AR: 2.04% -> 10.00% | Helped |
| Add Lq to the Anti-NAF objective (ablation) | Anti-NAF on POKEMON · POKEMON | CIR: 13.72% -> 12.88% | Hurt |
| Add Lq to the Anti-NAF objective (ablation) | Anti-NAF on POKEMON · POKEMON | FAR@5%AR: 2.00% -> 8.52% | Helped |
| Use the full Anti-NAF objective rather than optimizing Lp only (ablation) | Anti-NAF on POKEMON · POKEMON | CIR: 10.60% -> 12.88% | Helped |
Surprising findings
- Prompts optimized only for reconstructing the target image (Lp only) perform worse, since their infringing outputs are easily blocked by the protection system.
- Caption-only prompts with amplification achieve 0.00% FAR at 15%/30% AR on LAION-mi, showing that naive repetition is not always effective.
Limitations
- Anti-NAF requires white-box access to the unprotected model and safe models, limiting applicability to black-box settings.
- Only online prompt selection among a candidate set is explored; online prompt optimization is left to future work.
- Infringement is judged by SSCD similarity percentiles rather than a standard legal or computable definition of infringement.
Experimental setup
Datasets: POKEMON LAION-mi
Benchmarks: POKEMON LAION-mi
Metrics: copyright infringement rate (CIR) false accept rate (FAR) at acceptance rate (AR) SSCD similarity percentiles
Baselines: Caption (w/o Amp.) CLIP-Interrogator PEZ Anti-NAF (w/o Amp.)
Builds on: near-access-freeness (NAF) CP-k PEZ Stable Diffusion
Closest papers by meaning
- ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Users (NeurIPS 2024 · similarity 0.85)
- The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.85)
- Blameless Users in a Clean Room: Defining Copyright Protection for Generative Models (NeurIPS 2025 · similarity 0.85)
- WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models (CVPR 2024 · similarity 0.84)
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.84)
- T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Models (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.