[Paper] Off-The-Shelf Image-to-Image Models Are All You Need To Defeat Image Protection Schemes

Source: arXiv - 2602.22197v1

Overview

Recent advances in generative AI have made it possible to repurpose off‑the‑shelf image‑to‑image models (e.g., Stable Diffusion, DALL‑E 2) as universal “denoisers” that strip away protective perturbations added to photos. The paper shows that these readily available tools can defeat a wide variety of image‑protection schemes—often more effectively than attacks that were specifically engineered for each defense.

Key Contributions

• Universal attack: Demonstrates that a single, prompt‑driven image‑to‑image model can neutralize all examined protection mechanisms, eliminating the need for bespoke attacks.
• Broad empirical coverage: Evaluates 8 case studies across 6 distinct protection schemes (e.g., watermarking, adversarial perturbations for style‑transfer blocking, deep‑fake mitigation).
• Performance edge: The generic attack matches or surpasses the success rates of specialized attacks while preserving the visual quality needed for downstream misuse.
• Open‑source toolkit: Releases a reproducible codebase that automates the prompt‑based denoising pipeline, encouraging further research and responsible disclosure.
• Security warning: Provides a concrete benchmark that future image‑protection methods must meet—defending against off‑the‑shelf generative models.

Methodology

1. Model selection – The authors pick popular, publicly available image‑to‑image diffusion models (e.g., Stable Diffusion’s img2img). No fine‑tuning is performed.
2. Prompt engineering – A simple textual cue such as “remove noise and restore the original photo” is supplied to the model along with the protected image.
3. Iterative refinement – The protected image is passed through the model once (or a few times) to produce a cleaned output.
4. Evaluation pipeline – For each protection scheme, the authors measure:
   • Attack success: whether the downstream malicious task (style transfer, deep‑fake generation, etc.) works after denoising.
   • Image utility: perceptual quality metrics (PSNR, SSIM) and human visual inspection.
5. Baseline comparison – Results are compared against the best known attacks that were custom‑built for each protection method.

The approach is deliberately lightweight: it leverages the model’s learned ability to “imagine” a clean version of a noisy input, guided only by a natural‑language prompt.

Results & Findings

• The generic attack outperforms specialized methods on 6 out of 8 cases.
• Image quality after denoising remains high (average SSIM > 0.90), meaning the cleaned images are still useful for the attacker’s downstream goals.
• The attack works without any knowledge of the protection algorithm, demonstrating a systemic vulnerability.

Practical Implications

• Developers of image‑sharing platforms (e.g., social networks, stock‑photo sites) can no longer rely on “imperceptible” perturbations as a robust safeguard against content scraping or unauthorized style‑transfer.
• Security teams must treat off‑the‑shelf generative models as a threat vector; simply patching a specific attack will not suffice.
• AI product builders should consider integrating adversarial training that explicitly includes generative‑model denoising in the threat model, or move toward cryptographic watermarking that survives diffusion‑based restoration.
• Compliance and legal: Companies that claim “protected images” may need to revise their risk assessments, as the protection can be stripped with publicly available tools.
• Research community: The paper establishes a new benchmark—any future protection method should be evaluated against a baseline that uses an unmodified diffusion model with a generic prompt.

Limitations & Future Work

• The attack’s success hinges on the availability of high‑quality diffusion models; low‑resource environments may see reduced efficacy.
• Prompt engineering is kept simple; more sophisticated prompts could further boost performance, but also raise the attack’s complexity.
• The study focuses on imperceptible perturbations; defenses that embed visible watermarks or cryptographic signatures were not evaluated.
• Future work suggested includes: developing provably robust protection schemes, exploring defenses that specifically target diffusion‑based denoising, and extending the analysis to video and 3‑D assets.

Authors

• Xavier Pleimling
• Sifat Muhammad Abdullah
• Gunjan Balde
• Peng Gao
• Mainack Mondal
• Murtuza Jadliwala
• Bimal Viswanath

Paper Information

• arXiv ID: 2602.22197v1
• Categories: cs.CV, cs.AI
• Published: February 25, 2026
• PDF: Download PDF