Research map / Adversarial robustness and security / Attacks on text and graphs
Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that popular style-mimicry protections (Glaze, Mist, Anti-DreamBooth) can be circumvented by simple robust mimicry methods such as Noisy Upscaling, validated with a MTurk user study.
Problem
Style protections (Glaze, Mist, Anti-DreamBooth) add adversarial perturbations to artworks to stop diffusion-based style mimicry; it is unclear whether they remain effective against an adaptive forger.
Approach
Combine off-the-shelf preprocessing (Gaussian noising, DiffPure, and a novel Noisy Upscaling that adds Gaussian noise before the Stable Diffusion Upscaler) with standard fine-tuning of SD 2.1 to produce robust mimicry; a white-box IMPRESS++ variant is also included. Effectiveness is measured with a rigorous human user study rather than automated metrics.
Key results
- Noisy Upscaling achieves a median success rate above 40% against each protection tool, approaching the 50% indistinguishability point.
- Best-of-4 selection yields success rates of 56.6% (Anti-DreamBooth), 56.6% (Glaze) and 62.0% (Mist) for quality, above the 50% threshold.
- Naive mimicry on Glaze reaches 22.2% quality success, versus the at most 10% bound claimed in Glaze's original evaluation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Noisy Upscaling rather than naive mimicry to protected artworks | Style mimicry against Anti-DB, Glaze, and Mist · Protected artist artwork; quality evaluation | success rate: 11.6% -> 45.0%; 22.2% -> 39.4%; 9.0% -> 42.8% | Helped |
| Apply Noisy Upscaling rather than naive mimicry to protected artworks | Style mimicry against Anti-DB, Glaze, and Mist · Protected artist artwork; style evaluation | success rate: 21.8% -> 44.0%; 30.8% -> 41.6%; 19.4% -> 44.2% | Helped |
| Select the best of four robust mimicry methods for each generation | Style mimicry against the three protection tools · Protected artist artwork; quality evaluation | success rate: 56.6%; 56.6%; 62.0% | Helped |
| Select the best of four robust mimicry methods for each generation | Style mimicry against the three protection tools · Protected artist artwork; style evaluation | success rate: 52.4%; 51.2%; 53.4% | Helped |
| Use Noisy Upscaling rather than JPEG compression before upscaling | Robust style mimicry · Protected artist artwork | success rate | Helped |
| Use the off-the-shelf HuggingFace finetuning script instead of the Glaze evaluation script | Glaze-protected images · Style mimicry | success rate: at most 10% -> 30% | Hurt |
| Use Noisy Upscaling for historical rather than contemporary artists | Robust style mimicry · Historical and contemporary artists | success rate: 42.2%; 43.5% | No clear effect |
| Use IMPRESS++ rather than simple preprocessing methods | Robust style mimicry · Protected artist artwork | success rate | No clear effect |
Surprising findings
- Glaze protections degrade substantially under a different off-the-shelf fine-tuning script, with no circumvention attempt needed.
- Robust mimicry success is similar for historical (42.2%) and contemporary artists (43.5%) under Noisy Upscaling.
Limitations
- Only 10 artists and about 10 MTurk annotators per comparison; the study is small and not conducted with artists.
- Glaze was used only as a black-box Windows binary (v1.1.1), and later Glaze and Mist versions were only partially evaluated.
- Protections were not designed with knowledge of the robust mimicry methods, so results may not generalize to adaptive protections.
Experimental setup
Datasets: protected artworks from 10 artists (5 historical, 5 contemporary from Artstation)
Metrics: success rate (human preference over unprotected mimicry)
Baselines: Glaze Mist Anti-DreamBooth IMPRESS DiffPure Naive mimicry
Builds on: IMPRESS DiffPure Glaze Mist Anti-DreamBooth
Closest papers by meaning
- StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbations (NeurIPS 2025 · similarity 0.89)
- Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? (CVPR 2024 · similarity 0.88)
- Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Models (CVPR 2025 · similarity 0.88)
- AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption (ICLR 2025 · similarity 0.88)
- Toward effective protection against diffusion-based mimicry through score distillation (ICLR 2024 · similarity 0.87)
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.