Research map / Multi-agent systems and games / LLM agents

Revisiting "Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing"

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Software engineering agent benchmarks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FaceLock, a PGD-based adversarial perturbation that targets a face recognition model and feature-embedding disparity inside the diffusion editing loop so edited portraits lose biometric identity, and argues that CLIP/SSIM/PSNR metrics are easily gamed.

Problem

Protecting personal portrait images from malicious diffusion-based editing; prior perturbations try to cancel edit effects and are unstable across diverse editing prompts.

Approach

Instead of nullifying edits, optimize adversarial perturbations so that the post-edit image is biometrically unrecognizable, by combining a face-recognition similarity loss, a feature-embedding disparity loss (CNN features of decoded vs source image) and an EditShield latent regularizer, all computed through the VAE encoder/decoder of InstructPix2Pix.

Key results

• FaceLock reaches FR similarity 0.315 versus 0.590 for PhotoGuard and 0.641 for EditShield on CelebA-HQ (Table 1).
• Under JPEG 60 purification FaceLock keeps FR at 0.709 vs 0.786 (PhotoGuard) and 0.744 (EditShield); under no purification it is 0.308 (Table 3).
• On FFHQ FaceLock achieves FR 0.356 (lowest among methods), with LPIPS 0.542 (Table A5).

Surprising findings

• CLIP-S and CLIP-SD rank over-editing higher, so several defenses score worse than no defense on CLIP-SD (Table A4).
• Pixel-level penalty (CVL-DP) mainly causes color shifts rather than facial feature change, so it does not improve visual disparity.

Limitations

• Tailored to single portraits; multiple-person images remain a challenge.
• Robustness to newer generative models such as rectified flow models is untested and may need adaptation.
• Evaluation uses only InstructPix2Pix as the target editing model with 25 hand-picked prompts.

Experimental setup

Datasets: CelebA-HQ FFHQ

Benchmarks: CelebA-HQ FFHQ

Metrics: CLIP-S PSNR SSIM LPIPS CLIP-I FR similarity (CVLFace) CLIP-SD

Baselines: PhotoGuard EditShield Untargeted encoder attack CW L2 attack VAE attack DiffPure

Builds on: PhotoGuard EditShield PGD CVLFace InstructPix2Pix

Closest papers by meaning

• XFeat Revisited: Reproducibility and Evaluation of a Lightweight Image Matcher (NeurIPS 2026 · similarity 0.96)
• [Re] Boosting the Visual Interpretability of CLIP via Adversarial Fine-Tuning (NeurIPS 2026 · similarity 0.96)
• Debate with Images: Detecting Deceptive Behaviors in Multimodal Large Language Models (ICML 2026 · similarity 0.89)
• DeceptionBench: A Comprehensive Benchmark for AI Deception Behaviors in Real-world Scenarios (NeurIPS 2025 · similarity 0.87)
• Among Us: A Sandbox for Measuring and Detecting Agentic Deception (NeurIPS 2025 · similarity 0.86)
• Multi-Agent Undercover Gaming: Hallucination Removal Through Counterfactual Test for Multimodal Reasoning (AAAI 2026 · similarity 0.86)