SEAL changes 5% of face pixels to block diffusion identity cloning
Original title: Location Matters: Sparse Latent-Variance Attacks for Face Privacy against Diffusion Personalization
On CelebA-HQ and VGGFace2, protected images stay above 41 dB PSNR while identity similarity falls to at most 0.15.
Researchers propose Sparse Encoder Attack on Latent Variance (SEAL), which adds sparse adversarial noise so text-to-image diffusion personalization cannot learn a person's identity from a few reference photos. SEAL changes only 5% of spatial locations, jointly choosing positions and values, and targets variance in a frozen VAE encoder's latent distribution. A saliency penalty keeps changes out of prominent facial areas. The authors report the best protected-image quality among compared methods, with SSIM 0.97 and LPIPS at most 0.07. Code and data are on GitHub.
Unconfirmed: Quality and identity-similarity figures are the authors' comparisons, not an independent evaluation.
- SEAL modifies only 5% of spatial locations in a facial image.
- Reported quality exceeds 41 dB PSNR, with 0.97 SSIM and at most 0.07 LPIPS.
- Identity similarity after diffusion personalization is at most 0.15.
- Experiments use CelebA-HQ and VGGFace2.
- Code and data are at github.com/Lvxan/SEAL.
From the original article
1 min read at arxiv.orgText-to-image diffusion models can learn and reproduce an individual's identity from only a few reference photos, creating risks of unauthorized and misleading content generation. Proactive defenses address this risk by adding adversarial perturbations to facial images before release, thereby disrupting identity acquisition during downstream personalization.
By Shuting Yang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.