Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch

TL;DR

This paper introduces a unified purification framework to evaluate and improve the robustness of image protections against model mismatch in diffusion-based editing, revealing a 'purify-once, edit-freely' failure mode.

Contribution

It proposes two practical purification methods, VAE-Trans and EditorClean, that effectively restore protected images across diverse editing tasks and protection techniques under model mismatch.

Findings

EditorClean improves PSNR by 3-6 dB and reduces FID by 50-70%

Protection signals are largely removed after successful purification

Existing protections often fail under model mismatch, highlighting the need for robust defenses.

Abstract

Diffusion models enable high-fidelity image editing but can also be misused for unauthorized style imitation and harmful content generation. To mitigate these risks, proactive image protection methods embed small, often imperceptible adversarial perturbations into images before sharing to disrupt downstream editing or fine-tuning. However, in realistic post-release scenarios, content owners cannot control downstream processing pipelines, and protections optimized for a surrogate model may fail when attackers use mismatched diffusion pipelines. Existing purification methods can weaken protections but often sacrifice image quality and rarely examine architectural mismatch. We introduce a unified post-release purification framework to evaluate protection survivability under model mismatch. We propose two practical purifiers: VAE-Trans, which corrects protected images via latent-space projection, and EditorClean, which performs instruction-guided reconstruction with a Diffusion Transformer to exploit architectural heterogeneity. Both operate without access to protected images or defense internals. Across 2,100 editing tasks and six representative protection methods, EditorClean consistently restores editability. Compared to protected inputs, it improves PSNR by 3-6 dB and reduces FID by 50-70 percent on downstream edits, while outperforming prior purification baselines by about 2 dB PSNR and 30 percent lower FID. Our results reveal a purify-once, edit-freely failure mode: once purification succeeds, the protective signal is largely removed, enabling unrestricted editing. This highlights the need to evaluate protections under model mismatch and design defenses robust to heterogeneous attackers.