JPEG Compressed Images Can Bypass Protections Against AI Editing

View on arXiv ← Back to list

Authors: Pedro Sandoval-Segura, Jonas Geiping, Tom Goldstein

Published: 2023-04-05 05:30:09+00:00

AI Summary

This research paper demonstrates that imperceptible perturbations used to protect images from malicious AI editing, as proposed by PhotoGuard, are easily bypassed by JPEG compression. JPEG compression removes the protective perturbations, allowing diffusion models to realistically edit the images despite the added protection. This highlights a critical weakness in current image protection methods.

Abstract

Recently developed text-to-image diffusion models make it easy to edit or create high-quality images. Their ease of use has raised concerns about the potential for malicious editing or deepfake creation. Imperceptible perturbations have been proposed as a means of protecting images from malicious editing by preventing diffusion models from generating realistic images. However, we find that the aforementioned perturbations are not robust to JPEG compression, which poses a major weakness because of the common usage and availability of JPEG. We discuss the importance of robustness for additive imperceptible perturbations and encourage alternative approaches to protect images against editing.

Key findings

JPEG compression readily bypasses the protections offered by imperceptible perturbations designed to prevent AI-powered image editing. This vulnerability is significant due to the widespread use of JPEG. The authors conclude that current imperceptible perturbation methods are inadequate for protecting images in high-stakes scenarios.

Approach

The authors evaluated the robustness of existing imperceptible perturbation-based image protection methods against JPEG compression. They found that JPEG compression, a common image transformation, effectively removes the perturbations, allowing for realistic image editing by diffusion models.

Datasets

UNKNOWN (Experiments used the open-source notebooks from the photoguard repository (Salman et al., 2023), which employs the Stable Diffusion Model (SDM) v1.5 (Rombach et al., 2022).)

Model(s)

Stable Diffusion Model (SDM) v1.5

Author countries

USA

← Previous