Source-linked AI summary
Anti-DreamBooth: Protecting users from personalized text-to-image synthesis
Thanh Van Le, Hao Phung, Thuan Hoang Nguyen, Quan Dao, Ngoc Tran, Anh Tran
TL;DR
DreamBooth can misuse a few public images to generate fake or harmful personalized images, creating a need for user-side protection. Anti-DreamBooth adds subtle adversarial noise before publication and evaluates several perturbation algorithms across facial benchmarks and model settings. The defense is reported effective in controlled and adverse conditions, although leaked clean images reduce its effectiveness.
Problem
DreamBooth can generate fake news and harmful images targeting individuals, while protection against this personalized text-to-image misuse remains an identified concern.
Method
Anti-DreamBooth adds subtle adversarial perturbations to users’ images so DreamBooth models trained on them produce distorted or poor-quality personalized images.
Results
Anti-DreamBooth is effective across evaluated model and prompt settings, including adverse model or prompt/term mismatches.
Takeaways & Limitations
Users can be proactively protected from malicious DreamBooth personalization by perturbing images before publication.
Takeaways & Limitations
Effectiveness decreases when attackers mix more clean images with perturbed images; the defense remains effective when half of the training images are perturbed.
Abstract
from arXiv · showhide
Text-to-image diffusion models are nothing but a revolution, allowing anyone, even without design skills, to create realistic images from simple text inputs. With powerful personalization tools like DreamBooth, they can generate images of a specific person just by learning from his/her few reference images. However, when misused, such a powerful and convenient tool can produce fake news or disturbing content targeting any individual victim, posing a severe negative social impact. In this paper, we explore a defense system called Anti-DreamBooth against such malicious use of DreamBooth. The system aims to add subtle noise perturbation to each user's image before publishing in order to disrupt the generation quality of any DreamBooth model trained on these perturbed images. We investigate a wide range of algorithms for perturbation optimization and extensively evaluate them on two facial datasets over various text-to-image model versions. Despite the complicated formulation of DreamBooth and Diffusion-based text-to-image models, our methods effectively defend users from the malicious use of those models. Their effectiveness withstands even adverse conditions, such as model or prompt/term mismatching between training and testing. Our code will be available at https://github.com/VinAIResearch/Anti-DreamBooth.git.
1. Introduction
Personalized text-to-image models enable realistic images of specific subjects from a few references, but DreamBooth can be misused for fake news and harmful content. Anti-DreamBooth proactively perturbs users’ images so DreamBooth models trained on them produce unusable outputs, including under mismatched conditions.
- DreamBooth personalizes text-to-image generation from a few reference images, enabling realistic images of specific subjects.
- DreamBooth misuse can generate photo-realistic fake news and harmful images targeting specific people.
- Anti-DreamBooth adds subtle adversarial noise before image publication so DreamBooth models trained on perturbed images fail to produce reasonable-quality target images.
- The defense adapts adversarial learning to disrupt individual diffusion sampling steps rather than directly targeting end-to-end image generation.
- Anti-DreamBooth successfully breaks DreamBooth attempts in controlled settings, producing prominent visual artifacts.
- The defense remains effective across text-to-image models and training prompts, including model or prompt/term mismatches between training and testing.
2. Related work
Related work spans diffusion-based text-to-image generation, personalization, adversarial attacks, and image cloaking. Anti-DreamBooth extends cloaking toward preventing harmful personalized diffusion outputs rather than artistic mimicry.
- Diffusion-based models have shown strong capacity for high-quality, editable text-to-image synthesis and include systems such as GLIDE, DALL-E 2, Imagen, eDiff-I, LDM, and StableDiffusion.
- Personalization methods adapt diffusion models either by optimizing text embeddings or by finetuning denoising networks to associate embeddings with new concepts.
- Adversarial attack research includes gradient-based methods such as FGSM, iterative variants, regularized perturbations, boundary searches, and black-box gradient estimation.
- Image cloaking proactively adds subtle noise to public images to disrupt unauthorized face recognition or image manipulation.
- GLAZE and AdvDM also target personalized text-to-image diffusion models, whereas Anti-DreamBooth focuses on preventing fake or harmful personalized images rather than artistic mimicry.
3. Problem
The paper formulates protection against DreamBooth personalization by perturbing published images so models trained on them generate degraded or incorrect personalized outputs. It considers diffusion-model training, evaluation criteria, and settings ranging from known attacker details to mismatched or leaked clean images.
- Diffusion background: Diffusion generation complicates direct end-to-end optimization because outputs arise through stochastic, sequential denoising steps controlled by prompts.The paper describes forward noise addition and backward denoising, and evaluates primarily with publicly available Stable Diffusion versions.
- DreamBooth background: DreamBooth personalizes text-to-image diffusion models by finetuning them on a small reference set while combining instance reconstruction with prior preservation.The method uses a generic instance prompt and a prior prompt with the original model weights.
- Problem definition: The defense publishes x′ = x + δ while keeping x private, then seeks perturbations that reduce the personalized generation ability of a DreamBooth model trained on the published set.The adversary collects the published images and finetunes a text-to-image generator on them.
- Problem definition: Defense success is defined by generated images having severe quality defects, unrecognizable subjects, or mismatched identities, rather than by a single unified evaluation function.The paper notes that no all-in-one image-quality metric covers these criteria.
- Defense settings: The problem is evaluated under convenient settings with known generators and prompts, adverse mismatches, and uncontrolled mixtures of perturbed and clean images.In the uncontrolled setting, clean images can allow DreamBooth to learn enough to generate reasonable personalized images.
4. Proposed defense methods
Anti-DreamBooth approximates the difficult bilevel defense objective by disrupting DreamBooth training through surrogate-guided perturbation learning. It provides untargeted, targeted, alternating, and ensemble variants to address changing models and adverse conditions.
- Core optimization: The defense attacks DreamBooth’s learning process by maximizing reconstruction loss at randomly selected denoising timesteps rather than optimizing the full generation process.The timestep-based scheme is reported to remain effective in breaking generation outputs.
- Surrogate-guided methods: FSMG uses a fixed surrogate DreamBooth model trained on clean samples to guide perturbations that maximize the conditional reconstruction loss.The surrogate can be learned once even as target and adversarial image sets change.
- Surrogate-guided methods: ASPL alternates surrogate finetuning on clean reference data, perturbation learning on current adversarial samples, and actual surrogate updates.This procedure is intended to make the surrogate better mimic models trained by malicious users on perturbed data.
- Targeted approaches: Targeted variants steer outputs toward a selected target image, addressing the possibility that untargeted perturbations learn directions whose effects cancel.The targeted scheme can be applied to the preceding methods, producing variants such as T-FSMG and T-ASPL.
- Ensemble approaches: Ensemble approaches use surrogate models finetuned from different pretrained generators when the attacker’s pretrained text-to-image model is unknown.This is proposed for adverse settings where transfer from a single surrogate may be unreliable.
5. Experiments
Experiments evaluate Anti-DreamBooth on two facial datasets across convenient, adverse, and uncontrolled settings. ASPL consistently disrupts DreamBooth personalization, including under model or prompt mismatches, while mixed clean and perturbed images reduce effectiveness.
- Experimental setup: The evaluation uses CelebA-HQ and VGGFace2, selecting 50 identities per dataset and resizing three four-image subsets per subject to 512 × 512.CelebA-HQ provides 307 annotated subjects, while VGGFace2 contains around 3.31 million images across 9131 identities.
- Evaluation metrics: FDFR measures failed face detection, while ISM measures identity similarity using ArcFace embeddings and cosine distance to clean reference images.The evaluation also includes image-quality metrics for generated outputs.
- Convenient setting: In convenient settings, untargeted FSMG and ASPL increase face-detection failures and reduce identity matching, with ASPL outperforming FSMG and targeted methods performing poorly.ASPL is therefore used in the follow-up experiments.
- Convenient setting: 4.72 to 0.42 and 3.70 to 1.16: ASPL reduced generated-image quality and identity preservation in a VGGFace2 user study.The study used 40 participants, 50 identities, two DreamBooth models per identity, and six generated images per model.
- Adverse settings: ASPL remains effective across Stable Diffusion versions, against Textual Inversion and LoRA, and when training and testing models, terms, or prompts mismatch.An ensemble variant further improves defense in model-mismatch cases, while term mismatch has only a moderate effect.
- Adverse and uncontrolled settings: Gaussian blur and JPEG compression slightly weaken ASPL, but generated-image quality remains substantially degraded; effectiveness also persists against the commercial Astria service.In uncontrolled settings, defense remains effective when half the training images are perturbed but declines as more clean images are introduced.
6. Conclusions
The paper proposes perturbing users’ images with subtle adversarial noise to counter misused DreamBooth models. The defense is reported as effective, including under adverse conditions, while future work targets improved imperceptibility, robustness, and uncontrolled settings.
- Anti-DreamBooth perturbs users’ images with subtle adversarial noise so DreamBooth models trained on them produce poor personalized images.
- The study designs several algorithms and extensively evaluates their effectiveness.
- The defense remains effective under adverse conditions.
- Future work aims to improve perturbation imperceptibility and robustness and address uncontrolled settings.
A.1. Ablation studies
Ablation studies examine defense performance across Stable Diffusion versions, datasets, algorithms, noise budgets, and mismatched training conditions. ASPL generally outperforms FSMG, while larger noise budgets improve defense but targeted defenses remain weak.
- Text-to-image generator version: The defense is evaluated across Stable Diffusion versions including v1.4 and v1.5.
- Dataset comparison: ASPL significantly decreases identity scores on CelebA-HQ, although its performance is weaker than on VGGFace2 because the images have less pose and quality diversity.
- Algorithm comparison: FSMG provides a slightly weaker defense than ASPL across metrics on VGGFace2 and CelebA-HQ.
- Noise budget: Increasing the noise budget improves defense scores for both FSMG and ASPL on both datasets, while ASPL outperforms FSMG on most evaluation scores.
- Adverse settings: ASPL remains effective under model and term mismatching on CelebA-HQ, with the ensemble approach performing best across measurements.
- Uncontrolled settings: Uncontrolled CelebA-HQ experiments observe the same trend previously reported on VGGFace2.
B. Real-world test.
The real-world test evaluates ASPL against Astria, a commercialized black-box service using a DreamBooth setup. Adversarial images significantly reduce generated-image quality across complex prompts and target models.
- Real-world setting: The experiment tests whether the defense disrupts personalized generation in a real-world black-box commercial service.
- Test platform: Astria supports uploading target-subject images, entering prompts, and selecting model settings; the test uses its recommended setting.
- Results: ASPL adversarial images significantly reduce generated-image quality across complex prompts and both target models.
- Qualitative analysis: The study provides qualitative results to support the quantitative defense analysis and visualize its effects.
C.1. Ablation studies
Qualitative ablations show how model versions, noise budgets, mismatched prompts or terms, and clean-image mixtures affect ASPL. Larger budgets increase distortion but also noise visibility, while uncontrolled protection strengthens as more perturbed data are used.
- Generator version: ASPL produces strongly distorted outputs across Stable Diffusion v1.4 and v1.5 on VGGFace2 and CelebA-HQ.
- Noise budget: Increasing the noise budget makes perturbations more visible and increases output distortion, creating a trade-off between imperceptibility and defense strength.
- Model mismatching: Model mismatching remains effective when perturbations learned with v1.4 are transferred to DreamBooth models based on v2.1 and v2.0.
- Model mismatching: E-ASPL combines knowledge from SD v1.4, v1.5, and v2.1 and shows superior performance against model mismatching.
- Term and prompt mismatching: Term and prompt mismatching can weaken artifacts or alter defense behavior and the identity of generated targets.
- Uncontrolled settings: In uncontrolled settings, the method becomes more effective as more perturbed data are used and less effective as clean images increase.
D. Robustness Evaluation
The evaluation uses ASPL with η = 0.05 as the default configuration and additionally tests a prompt different from the training prompt.
- ASPL with η = 0.05 is the default configuration used throughout the main-paper experiments.
- The robustness evaluation includes quantitative and qualitative results for a prompt different from the one used during training.
D.1. Robustness to Image Compression
The defense remains effective after JPEG compression and Gaussian blur, although stronger processing can remove artifacts while degrading generated-image quality.
- 50% and above JPEG compression preserves significant artifacts in generated images, indicating that the defense remains effective.At 30% compression, most adversarial artifacts are removed, but low-quality training images still cause significant image degradation.
- Gaussian blur leaves perceivable defense artifacts through kernel size 7.Larger kernels lessen the artifacts but also make generated images blurry with unnatural backgrounds.
D.3. Robustness to Adverse Cleaner
The defense is evaluated under adverse image-processing and deployment conditions, including cleaning, compression, model mismatch, prompt or term mismatch, and uncontrolled settings. The reported results describe continued qualitative or quantitative defense performance across these conditions.
- Adverse Cleaner: The defense remains robust against the smoothing effect of denoised images produced by the Adverse Cleaner.This evaluation uses qualitative results from Fig. 16.
- Discussion: The authors caution that Gaussian blur and JPEG compression do not represent all possible techniques for removing the protection.They identify additional algorithms and techniques as future work for improving robustness.
- Model mismatch: ASPL is evaluated when the Stable Diffusion model used for perturbation learning differs from the model used for DreamBooth fine-tuning.The tested mismatches include v1.4 → v2.1 and v1.4 → v2.0.
- Ensemble models: E-ASPL combines Stable Diffusion versions v1.4, v1.5, and v2.1 and is validated on DreamBooth models fine-tuned with v2.1 and v2.0.
- Prompt and term mismatch: ASPL is tested when the DreamBooth training term changes from “sks” to “t@t” and when the training prompt changes to “a DSLR portrait of sks person.”
- Uncontrolled and image-processing settings: Uncontrolled settings compare perturbed examples with leaked clean examples, while additional tests vary JPEG compression, Gaussian blur, and the Adverse Cleaner.