Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes

View on arXiv ← Back to list

Authors: Xavier Pleimling, Sifat Muhammad Abdullah, Gunjan Balde, Peng Gao, Mainack Mondal, Murtuza Jadliwala, Bimal Viswanath

Published: 2026-02-25 18:46:30+00:00

Comment: This work has been accepted for publication at the IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). The final version will be available on IEEE Xplore. To IEEE SaTML 2026

AI Summary

This paper demonstrates that off-the-shelf image-to-image Generative AI models can act as generic "denoisers" to effectively remove a wide range of imperceptible protective perturbations from images. Across 8 case studies covering 6 diverse image protection schemes, this general-purpose attack outperforms existing specialized attacks while preserving image utility for adversaries. The findings highlight a critical and widespread vulnerability in current image protection methods, emphasizing the urgent need for more robust defenses benchmarked against off-the-shelf GenAI attacks.

Abstract

Advances in Generative AI (GenAI) have led to the development of various protection strategies to prevent the unauthorized use of images. These methods rely on adding imperceptible protective perturbations to images to thwart misuse such as style mimicry or deepfake manipulations. Although previous attacks on these protections required specialized, purpose-built methods, we demonstrate that this is no longer necessary. We show that off-the-shelf image-to-image GenAI models can be repurposed as generic ``denoisers using a simple text prompt, effectively removing a wide range of protective perturbations. Across 8 case studies spanning 6 diverse protection schemes, our general-purpose attack not only circumvents these defenses but also outperforms existing specialized attacks while preserving the image's utility for the adversary. Our findings reveal a critical and widespread vulnerability in the current landscape of image protection, indicating that many schemes provide a false sense of security. We stress the urgent need to develop robust defenses and establish that any future protection mechanism must be benchmarked against attacks from off-the-shelf GenAI models. Code is available in this repository: https://github.com/mlsecviswanath/img2imgdenoiser

Key findings

Off-the-shelf image-to-image GenAI models, guided by simple text prompts, effectively remove various protective perturbations across 8 case studies, often outperforming specialized attacks while preserving image utility. The findings demonstrate a critical and widespread vulnerability in current image protection schemes, highlighting that even sophisticated protections (e.g., latent space, semantic properties) are susceptible. Furthermore, the paper shows that creating robust, attack-aware protection schemes is challenging, underscoring the urgent need for stronger defenses.

Approach

The authors repurpose off-the-shelf image-to-image generative AI models as generic 'denoisers' to remove protective perturbations from images. This is achieved by guiding the image-to-image models with simple text prompts (e.g., "Denoise this image"), without requiring any protection-specific adaptations or fine-tuning.

Datasets

Flickr Faces High Quality (FFHQ), Stable Diffusion Prompt (SDP) dataset, W-Bench, Pokemon dataset, WikiArt, LAION-Aesthetic dataset

Model(s)

UNKNOWN

Author countries

USA, India

← Previous