Research map / Image generation / Editing and style transfer
BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BlurGuard, which applies learnable per-region (SAM-based) Gaussian blur to adversarial protection noise and adds a power-spectrum regularizer so the noise matches natural image frequency statistics, making it harder to reverse by purification.
Problem
Adversarial noise used to protect images against text-to-image editing is easily reversed by simple purification (JPEG, diffusion-based purification), so protection is not robust in the worst case.
Approach
Adversarial protection noise should be imperceptible and also irreversible, i.e., spectrally natural; BlurGuard learns per-region Gaussian blur intensities via a power-spectrum (RAPSD) regularizer and optimizes the noise with PGD under that blur, plugging into existing protection objectives.
Key results
- On ImageNet-Edit image-to-image, BlurGuard improves naturalness LPIPS to 0.21 vs 0.30 for the best baseline (SDS) and worst-case FID 107.88 vs 98.27 (AdvDM).
- BlurGuard retains 92.9% of its FID protection after purification versus 38.5% to 48.4% for other methods.
- On Helen inpainting, worst-case LPIPS reaches 0.45 vs 0.34 for the second-best baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply BlurGuard to image protection | Image protection methods · ImageNet-Edit, Helen, and MagicBrush | worst-case FID: 98.27 -> 107.88; 133.78 -> 162.92; 123.54 -> 138.22 | Helped |
| Add BlurGuard to AdvDM | AdvDM · ImageNet-Edit | worst-case FID: 98.27 -> 101.84 | Helped |
| Add BlurGuard to Mist | Mist · ImageNet-Edit | worst-case FID: 90.96 -> 137.91 | Helped |
| Add BlurGuard to Anti-DreamBooth | Anti-DreamBooth · DreamBooth | worst-case FID: 127.93 -> 145.75 | Helped |
| Replace adaptive blur intensities with fixed σ values (0, 0.5, or 1.0) (ablation) | BlurGuard · Image-to-image generation, SD-v1.4 | worst-case protection effectiveness | Hurt |
| Use one blur intensity for the whole image instead of per-region intensities (ablation) | BlurGuard · Image-to-image generation, SD-v1.4 | worst-case protection effectiveness | Hurt |
| Remove power spectrum regularization while learning σ (λ=0) (ablation) | BlurGuard · Image-to-image generation, SD-v1.4 | naturalness | Hurt |
| Remove adaptive blur (no σ; PhotoGuard-equivalent variant) (ablation) | BlurGuard · Image-to-image generation, SD-v1.4 | naturalness | Hurt |
| Use learned σ with ε=4/255 (ablation) | BlurGuard · Image-to-image generation, SD-v1.4 | worst-case protection effectiveness | Hurt |
Surprising findings
- Constant blur (sigma fixed at 0, 0.5, 1.0) degrades SSIM despite high PSNR, indicating blurring alone harms image likelihood.
- Optimizing blur intensities jointly with the adversarial loss conflicts with the frequency objective, so the blur is learned first and frozen.
Limitations
- Protection is lost once an unprotected copy of the image becomes public.
- Does not address manual editing by humans.
- Demonstrating vulnerabilities may help adversaries exploit purification tools.
Experimental setup
Datasets: ImageNet-Edit Helen WikiArt MagicBrush VGGFace2 InpaintGuardBench
Benchmarks: ImageNet-Edit Helen MagicBrush InpaintGuardBench WikiArt
Metrics: LPIPS SSIM PSNR FID IA
Baselines: PhotoGuard AdvDM Mist SDS DiffusionGuard EditShield Glaze Anti-DreamBooth High-Frequency Anti-DreamBooth
Builds on: PhotoGuard AdvDM Mist Segment Anything PGD
Closest papers by meaning
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.91)
- Adversarial Robust Safeguard for Evading Deep Facial Manipulation (AAAI 2024 · similarity 0.87)
- Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing (CVPR 2025 · similarity 0.85)
- StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbations (NeurIPS 2025 · similarity 0.85)
- Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models (AAAI 2025 · similarity 0.85)
- Distraction is All You Need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing (CVPR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.