Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples

Chumeng Liang; Xiaoyu Wu; Yang Hua; Jiaru Zhang; Yiming Xue; Tao Song; Zhengui Xue; Ruhui Ma; Haibing Guan

Source-linked AI summary

Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples

Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, Haibing Guan

arXiv:2302.04578v2Feb 9, 2023cs.CVcs.AIcs.CRcs.LG

TL;DR

Unauthorized artwork use for training diffusion models creates copyright concerns, motivating protection methods that preserve visible image content while disrupting model feature extraction. The paper defines and evaluates diffusion-model adversarial examples and proposes AdvDM, with experiments showing effective interference with feature extraction and imitation in reported scenarios.

Problem
Artists lack technology to prevent or track unauthorized artwork use for training AI-for-Art diffusion models and subsequent style imitation.
Method
The paper builds a framework for diffusion-model adversarial examples and uses AdvDM to add small perturbations that mislead feature extraction during conditioning.
Results
Extensive experiments across single-category and art-style datasets show that the adversarial examples effectively protect images from being learned, imitated, and copied by diffusion models.
Takeaways & Limitations
The work presents adversarial examples as a paradigm and practical tool for protecting human-created artworks from unauthorized use by diffusion-model AI-for-Art applications.
Takeaways & Limitations
The evaluation assumes a dependency between the generated condition and the image sample, and the perturbation scale is constrained by a usually small constant ϵ.

Abstract

from arXiv · show

Recently, Diffusion Models (DMs) boost a wave in AI for Art yet raise new copyright concerns, where infringers benefit from using unauthorized paintings to train DMs to generate novel paintings in a similar style. To address these emerging copyright violations, in this paper, we are the first to explore and propose to utilize adversarial examples for DMs to protect human-created artworks. Specifically, we first build a theoretical framework to define and evaluate the adversarial examples for DMs. Then, based on this framework, we design a novel algorithm, named AdvDM, which exploits a Monte-Carlo estimation of adversarial examples for DMs by optimizing upon different latent variables sampled from the reverse process of DMs. Extensive experiments show that the generated adversarial examples can effectively hinder DMs from extracting their features. Therefore, our method can be a powerful tool for human artists to protect their copyright against infringers equipped with DM-based AI-for-Art applications. The code of our method is available on GitHub: https://github.com/mist-project/mist.git.

1. Introduction

Diffusion models enable artwork generation but create copyright risks when unauthorized paintings are used for training and style imitation. The paper introduces a framework and AdvDM algorithm that use adversarial examples to hinder feature extraction while preserving image semantics.

Diffusion models have accelerated artwork generation, contributing to commercialization of AI-for-Art applications.
Artists lack technology to prevent or track unauthorized artwork use for AI-for-Art training, increasing legal and evidentiary burdens.
Adversarial examples add tailored, tiny perturbations that remain semantically similar while making images unrecognizable to diffusion models.
Generating diffusion-model adversarial examples is difficult because models extract image features as conditions and optimize indirectly through a variational bound.
The paper defines and evaluates diffusion-model adversarial examples by misleading the condition stage into producing an out-of-distribution condition and degrading conditional generation.
AdvDM uses a Monte Carlo estimate of the objective to generate adversarial examples, and experiments test protection across single-category and art-style datasets.

2. Background

Diffusion models are latent-variable generative models that use forward and reverse Markov processes to generate data, including conditioned images. The background contrasts their indirect variational-bound training with classification models and prior generative-model attacks.

Generative models learn a data distribution pθ(x), often matching observations with latent variables in a lower-dimensional space.
Because pθ(x) is difficult to optimize directly, generative models optimize a variational bound instead.
Conditional generative models use conditions such as categories, base images, characteristics, or natural-language prompts to model pθ(x|c).
Diffusion models construct latent variables through a forward Markov chain and use a reverse Markov chain to recover the data.
Latent diffusion models perform denoising in latent space and are mainstream in AI-for-Art applications because of image quality and sampling efficiency.
Classification models estimate pθ(y|x) and can be misled by adversarial inputs, while prior generative-model work considered attacks with different objectives or model assumptions.

3. Adversarial Examples for Diffusion Models

This section defines adversarial examples for diffusion models as minimally perturbed images that reduce feature extraction, then introduces AdvDM and an inference-based evaluation framework.

3.1. Adversarial Examples for Diffusion Models: Adversarial examples minimize a diffusion model’s probability for an image while constraining perturbations to preserve human-visible similarity and image semantics.The perturbed image is written as x′ = x + δ with ∥δ∥≤ϵ.
3.1. Adversarial Examples for Diffusion Models: Because pθ(x) is not practically computable, the objective estimates image likelihood using latent variables sampled through Monte Carlo.The optimization minimizes pθ(x0:T) across different samples of x1:T to approximate minimizing pθ(x′).
3.2. AdvDM: Generating Adversarial Examples by Monte Carlo: AdvDM generates adversarial examples by repeatedly estimating gradients over sampled latent variables and applying signed gradient-ascent steps.In practice, the latent-variable distribution is set to the posterior q(x1:T|x0), which empirically performs well.
3.3. Evaluating Adversarial Examples for Diffusion Models: The evaluation models diffusion inference as feature extraction followed by conditional image generation, covering text-to-image, style-transfer, and image-to-image scenarios.Conditions may be natural-language prompts or latent variables, and the paper describes three corresponding copyright-violation settings.
3.3. Evaluating Adversarial Examples for Diffusion Models: A good adversarial example prevents accurate condition extraction and lowers generated-image quality, measured using FID and Precision.The evaluation samples a condition from pθ(c|xadv), generates xg from pθ(x|cg), and computes a quality metric.

4. Experiment

Experiments evaluate AdvDM on latent diffusion models across text-to-image, style-transfer, image-to-image, sampling-step, perturbation-budget, and defense settings. The adversarial examples hinder feature extraction and style imitation, while stronger settings increase attack effects but can raise inference time.

Experimental setup: AdvDM is evaluated with an LDM backbone under an l∞ perturbation constraint, reflecting its intended use against mainstream AI-for-Art applications.The experiments use latent diffusion models and fix the l∞ norm for generating adversarial examples.
Text-to-image generation: High FID and low Precision indicate that generated images fail to capture contents from adversarial examples; AdvDM significantly increases FID and decreases Precision.Recall does not vary consistently across the evaluation.
Style transfer: In WikiArt style transfer, conditioning on adversarial examples produces styles significantly different from the input paintings, unlike conditioning on clean examples.The experiment selects 20 paintings from each of 10 artists and trains one pseudo-word per artist.
Image-to-image generation: In image-to-image generation with Stable Diffusion, images based on adversarial examples are unrealistic compared with images based on clean examples.The evaluation applies AdvDM to open-source Pexels photos before conditional generation.
Ablation study: More Monte Carlo sampling steps strengthen the attack but increase inference time, so the main experiments fix the default at 40 steps.The sampling-step study uses LSUN-airplane images and compares settings from 10 to 1,000 steps.
Ablation study: A 4/255 perturbation budget already significantly affects generated-image quality, while JPEG and TVM have limited defense effectiveness and SR only partially defends.Preprocessing defenses do not fully restore the semantic information of the original images.

5. Related Work

Prior work has studied adversarial examples across several domains and generative-model settings, but diffusion models lacked a proper general framework for defining them.

Adversarial examples have been studied for image and graph classification, text comprehension, and decision making.
Existing generative-model research mainly examined examples produced by generative models or attacks that mislead classifiers.
Prior theory for flow-based models relied on a normally distributed data assumption and did not provide a general formulation.

6. Conclusion

The paper presents a framework and algorithm for protecting artworks from unauthorized diffusion-model use, while situating the problem within unresolved copyright and fair-use debates.

The paper introduces a theoretical framework and algorithm for generating diffusion-model adversarial examples to protect human-created artworks.
Extensive experiments support using the approach as a copyright-protection tool against unauthorized use of artworks by diffusion-model AI-for-Art applications.
AI-for-Art applications have lowered the threshold for artistic creation while leaving copyright issues unresolved.
Ethical Issues: Unauthorized use of copyright-protected training images may constitute reproduction and distribution without consent, with LAION identified as one major data source.
Ethical Issues: The discussion notes that fair use may support scientific-research training, whereas commercial generation and direct competition with artists weaken that justification.
Ethical Issues: Copyright law must balance AI-for-Art development with artists’ interests as legal responses to technological change develop.

B.1. Ablation Study

The ablation study examines perturbation budgets and alternative attack constructions, finding that larger budgets degrade generations more visibly and that adversarial examples can remain visually close to clean images.

Ablation Study: Greater perturbation budgets make generated airplane figures vaguer.
Ablation Study: Adversarial examples show almost no human-visible differences from their corresponding clean images, yet severely reduce generated-image quality.
Ablation Study: The study compares AdvDM with other potential diffusion-model adversarial-example methods because no prior formulation existed.
Ablation Study: The compared methods use the same optimization steps and perturbation-budget settings as the main experimental setup.
Ablation Study: Classifier-based attacks transfer PGD from an InceptionV3 classifier to the target generation setting.
Ablation Study: Embedding Attack applies PGD to the latent embedding layer and optimizes a loss comparing clean-image and perturbed-image representations.The resulting adversarial example is defined as x′ := x + δ, with δ constrained by a perturbation budget.

C.3. PGD

This comparison evaluates PGD-based alternatives for textual-inversion generation and contrasts their effects on generated-image quality and semantics.

PGD: PGD (LDM) applies PGD to the LDM loss and is equivalent to the proposed method when the sampling-step count N is 1.
PGD: AdvDM achieves the best FID results among the benchmarked methods, while Embedding Attack is relatively promising especially in Precision.
PGD: PGD on DMs performs poorly because omitting the sampling process fails to effectively decrease probability pθ.
PGD: Under Embedding Attack, background noise appears while image semantics remain largely intact; under AdvDM, shape and color are largely affected.

D. Implementation Details

The evaluation procedures cover text-to-image generation and style transfer based on textual inversion, using pseudo-words optimized from image groups and generated outputs evaluated against reference data. Additional visualization examines how AdvDM affects semantic information under different attacks.

Text-to-image generation: The text-to-image evaluation separates 1,000 images into five-image groups, generates 50 images per group, and computes FID, Precision, and Recall against the dataset.The metrics are computed between generated outputs and the reference dataset D.
Style transfer: Style transfer separates the dataset by artistic style before applying textual inversion to each style group.The supplied implementation passages introduce the style-group partition but do not provide the complete subsequent generation steps.
Text-to-image generation: Textual inversion initializes a pseudo-word vector, optimizes it using randomly selected images and diffusion loss, then generates images from a target prompt.The procedure uses a prompt containing “in the style of S∗” for style-related generation.
Attack comparison: AdvDM’s visual analysis compares generated images under different attacks and observes stronger influence on semantic information from AdvDM.The pseudo-word for this comparison is derived from the Lsun-airplane dataset.

D.1. Details of Evaluation

The evaluation implements AdvDM on latent diffusion models by perturbing images through sampled latent trajectories and random timestamps. Experimental metrics include FID, Precision, and Recall computed over complete category datasets.

Metrics: FID, Precision, and Recall are calculated over the whole category dataset using an open-source FID package and an authors’ provided evaluation script.The Precision and Recall script is attributed to Dhariwal and Nichol.
AdvDM implementation: AdvDM takes an image, latent-diffusion parameters, an encoder and denoising autoencoder, Monte Carlo samples, and perturbation budgets, and outputs an adversarial example.The implementation specifies step-wise budget α and overall budget ϵ.
AdvDM implementation: Each perturbation step samples a latent trajectory and a random timestamp before adding a gradient-sign perturbation to the image.The sampled trajectory is represented as x(i)_1:T, with t sampled uniformly from 1 to T.

E. Protection Effectiveness against Stable Diffusion

The Stable Diffusion experiments evaluate protection on paintings by Van Gogh, Picasso, and Matisse using textual-inversion style transfer. The reported visual comparisons show adversarial examples disrupting generated imitation outputs.

Experimental setup: The experiment selects 20 WikiArt paintings each from Vincent Van Gogh, Pablo Picasso, and Henri Matisse to generate adversarial examples.Stable Diffusion is used as the evaluated AI-for-Art application.
Experimental setup: The setup uses 100 sampling steps, perturbation budget ϵ = 8/255, step length α = 1/255, and 8,000 textual-inversion optimization steps.Textual inversion uses step length 0.005, with reconstruction strength set to 0.5.
Visual comparison: Figures 10–15 compare clean and adversarial paintings with Stable Diffusion outputs for Matisse, Picasso, and Van Gogh.The supplied figure passages identify the artist-specific clean/adversarial and generated-image comparisons.

F.1. AdvDM on other image editing tasks

AdvDM is tested on inpainting, pose-guided synthesis, DreamBooth, and the commercial black-box application scenario.gg. Across these settings, adversarial examples degrade generated outputs through structural loss, artifacts, oversimplification, or chaotic textures.

F.1. AdvDM on other image editing tasks: Inpainting and pose-guided synthesis produce unusable outputs from adversarial examples, losing structure, showing artifacts, or becoming oversimplified.The pose-guided case specifically loses features of the art style.
DreamBooth: DreamBooth style transfer on adversarial examples adds chaotic textures to generated images, making them unusable in a Van Gogh imitation case.The comparison uses 20 paintings and contrasts clean-painting and adversarial-example groups.
scenario.gg transferability: scenario.gg provides a black-box transferability test because it uses closed-source diffusion models for art style transfer.The experimental setup remains consistent with the earlier configuration.
scenario.gg transferability: Compared with clean-image outputs, scenario.gg outputs based on adversarial examples contain weaker but still unusable chaotic textures.This result is reported for Matisse and Picasso cases.
Defenses: SR and DiffPure are evaluated as preprocessing defenses, but their effectiveness depends on the purification setting and DiffPure model resolution.The study uses scenario.gg and selects DiffPure’s ImageNet-trained model because of its higher resolution.
Defenses: Both SR and DiffPure fail to prevent chaotic textures, while DiffPure also lowers clean-example output quality because of limited resolution and purification degradation.The defense comparison is visualized in Figure 21.