Making image editors copy can help protect photos from edits
Copying As Defense: Protecting Images from Editing By Eliciting Model Copying · arXiv:2610.35566
In plain words
An image editor can use a photo and a written instruction to make a new image. Earlier protections tried to make the editor pay less attention to the photo, but it could still follow the instruction.
This paper introduces Copying-as-Defense, which slightly changes a photo to make the editor focus more on it and copy it instead. In tests with two editors, edits were judged successful less often on average for protected images than for unprotected ones. The result applies to the editors and images tested.
The research
When an editor is given a photo and an instruction, reducing its attention to the photo may still leave it able to make the requested change. Would pushing it to rely more on the reference photo prevent that edit?
CaD perturbs each reference image to increase early attention to it, making two tested diffusion-transformer editors less likely to complete requested edits.
Can reducing an editor’s attention to a reference photo still leave it free to follow the edit instruction? Copying-as-Defense (CaD) tests the opposite approach: perturb the photo so the editor attends to it more, especially in early processing.
In tests with two editors and two image collections, Qwen3-VL judged fewer edits successful on average with CaD than with unprotected photos or DeContext. The evaluator checked whether each output made the requested change while preserving identity and unrelated content and avoiding major artifacts. This supports the approach in those tested settings.
The results cover two diffusion-transformer editors and the tested image collections. The authors did not test whether compression, resizing, noise, or deliberate purification removes CaD’s protection.
What the evidence shows
- A different protection question
Copying-as-Defense (CaD) is an optimization-based protection method for photos used as references by instruction-based diffusion-transformer editors. Existing approaches try to reduce the editor’s attention to the reference.
But the editor can then allocate more attention to the written instruction and its developing output, so reducing reference attention may leave it able to carry out an edit.
- Test attention in both directions
The authors tested the direction of attention directly in FLUX. 1 Kontext. Suppressing attention to the reference still allowed instruction-following edits; forcing attention toward it increasingly made outputs reproduce the natural or a black reference.
On 10 BodyBench images, PickScore, which measures alignment with the requested edit, stayed high with no intervention or suppression and dropped as forced attention covered more blocks. This diagnostic motivated CaD’s objective.
- Make the editor copy
CaD adds a small perturbation to each reference photo to increase target queries’ attention to reference-image tokens in early transformer blocks. A target query represents part of the developing output.
Because each attention row has a fixed total, more attention to the reference leaves less for the instruction and output. The objective treats each query separately, and limiting it to early blocks shortens the computation needed to optimize the protection.
- Compare judged edit success
The main evaluation used FLUX. 1 Kontext-dev and FIBO Edit with InpaintGuardBench face portraits and BodyBench synthetic full-body photos paired with editing prompts.
Qwen3-VL-30B-A3B-Instruct judged whether each output made the requested edit while preserving identity and unrelated content and avoiding major artifacts. At a perturbation budget of 12/255, average edit success across the evaluated editors and collections was 24.0% with CaD, versus 81.4% for unprotected photos and 43.0% for DeContext.
- A strong result, bounded
A specific result shows the scope behind the average: on BodyBench with FLUX. 1 Kontext, 5.1% of outputs for CaD-protected images were judged successful, compared with 24.9% for DeContext, 44.2% for Diff-PGD, and 81.6% for unprotected images.
This comparison supports CaD in that setting, while the full evaluation covers only two editors and two image collections and does not test common image changes or deliberate protection removal.
Deep
- Original paper authors
- Salma Abdel Magid, Sanghyuk Chun, Eric Slyman, Kushal Kafle, Olga Russakovsky
- Submitted to arXiv
- License
- arXiv non-exclusive