mlsanityData to 7 Oct 2026

Anti-DreamBooth: Protecting users from personalized text-to-image synthesis

arXiv 2303.15433 ↗First posted 27 Mar 2023cs.CV cs.CR cs.LGcited by 114

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Text-to-image diffusion models are nothing but a revolution, allowing anyone, even without design skills, to create realistic images from simple text inputs. With powerful personalization tools like DreamBooth, they can generate images of a specific person just by learning from his/her few reference images. However, when misused, such a powerful and convenient tool can produce fake news or disturbing content targeting any individual victim, posing a severe negative social impact. In this paper, we explore a defense system called Anti-DreamBooth against such malicious use of DreamBooth. The system aims to add subtle noise perturbation to each user's image before publishing in order to disrupt the generation quality of any DreamBooth model trained on these perturbed images. We investigate a wide range of algorithms for perturbation optimization and extensively evaluate them on two facial datasets over various text-to-image model versions. Despite the complicated formulation of DreamBooth and Diffusion-based text-to-image models, our methods effectively defend users from the malicious use of those models. Their effectiveness withstands even adverse conditions, such as model or prompt/term mismatching between training and testing. Our code will be available at https://github.com/VinAIResearch/Anti-DreamBooth.git.

Key facts. Cited by 114 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 46 of its 67 references that are in the map. First posted on arXiv 27 Mar 2023.

Builds on

46 of 67 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples9 Feb

Other references · 45

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  12. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,466
33 more
  1. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  2. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  3. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  4. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,286
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  7. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,287
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  13. 2022Multi-Concept Customization of Text-to-Image Diffusioncited by 1,099
  14. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 921
  15. 2017VGGFace2: A dataset for recognising faces across pose and agecited by 911
  16. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  17. 2023Muse: Text-To-Image Generation via Masked Generative Transformerscited by 640
  18. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  19. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  20. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  21. 2023StyleGAN-T: Unlocking the Power of GANs for Fast Large-Scale Text-to-Image Synthesiscited by 212
  22. 2021Personalized Federated Learning using Hypernetworkscited by 210
  23. 2023Glaze: Protecting Artists from Style Mimicry by Text-to-Image Modelscited by 200
  24. 2020SER-FIQ: Unsupervised Estimation of Face Image Quality Based on Stochastic Embedding Robustnesscited by 111
  25. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 92
  26. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  27. 2020Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systemscited by 65
  28. 2021Countering Malicious DeepFakes: Survey, Battleground, and Horizoncited by 56
  29. 2022Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbationscited by 39
  30. 2021Initiative Defense against Facial Manipulationcited by 36
  31. 2020Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Facescited by 21
  32. 2022UnGANable: Defending Against GAN-based Face Manipulationcited by 15
  33. 2021Connecting Low-Loss Subspace for Personalized Federated Learningcited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 15; 2024: 38; 2025: 35; 2026: 26.

114 papers.

Sort:

By area:

  1. 2023Mix-of-Show: Decentralized Low-Rank Adaptation for Multi-Concept Customization of Diffusion Modelscited by 261
  2. 2023Mist: Towards Improved Adversarial Examples for Diffusion Modelscited by 91
  3. 2024Erasing Undesirable Concepts in Diffusion Models with Adversarial Preservationcited by 48
  4. 2024ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimizationcited by 45
  5. 2023MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learningcited by 42
  6. 2023Unlearnable Examples for Diffusion Models: Protect Data from Unauthorized Exploitationcited by 37
  7. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  8. 2023SimAC: A Simple Anti-Customization Method for Protecting Face Privacy against Text-to-Image Synthesis of Diffusion Modelscited by 34
  9. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  10. 2024How to Continually Adapt Text-to-Image Diffusion Models for Flexible Customization?cited by 32
  11. 2024A Survey on Personalized Content Synthesis with Diffusion Modelscited by 29
  12. 2023EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Modelscited by 27
38 more
  1. 2023Generative Watermarking Against Unauthorized Subject-Driven Image Synthesiscited by 21
  2. 2023FT-Shield: A Watermark Against Unauthorized Fine-tuning in Text-to-Image Diffusion Modelscited by 20
  3. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  4. 2023DUAW: Data-free Universal Adversarial Watermark against Stable Diffusion Customizationcited by 18
  5. 2023Targeted Attack Improves Protection against Unauthorized Diffusion Customizationcited by 18
  6. 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17
  7. 2024Non-confusing Generation of Customized Concepts in Diffusion Modelscited by 15
  8. 2024Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Imagescited by 15
  9. 2024Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Modelscited by 14
  10. 2025Improved Training Technique for Latent Consistency Modelscited by 13
  11. 2024A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authenticationcited by 12
  12. 2024Concept Arithmetics for Circumventing Concept Inhibition in Diffusion Modelscited by 11
  13. 2024RectifID: Personalizing Rectified Flow with Anchored Classifier Guidancecited by 11
  14. 2024Replication in Visual Diffusion Models: A Survey and Outlookcited by 11
  15. 2025AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruptioncited by 11
  16. 2025MCA-Bench: A Multimodal Benchmark for Evaluating CAPTCHA Robustness Against VLM-based Attackscited by 10
  17. 2023Towards Prompt-robust Face Privacy Protection via Adversarial Decoupling Augmentation Frameworkcited by 9
  18. 2024PRIME: Protect Your Videos From Malicious Editingcited by 9
  19. 2024Dormant: Defending against Pose-driven Human Image Animationcited by 9
  20. 2024ROICtrl: Boosting Instance Control for Visual Generationcited by 9
  21. 2024Hiding and Recovering Knowledge in Text-to-Image Diffusion Models via Learnable Promptscited by 8
  22. 2024Imperceptible Protection against Style Imitation from Diffusion Modelscited by 8
  23. 2023Warfare:Breaking the Watermark Protection of AI-Generated Contentcited by 7
  24. 2024U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AIcited by 7
  25. 2025StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbationscited by 7
  26. 2025Discrete Noise Inversion for Next-scale Autoregressive Text-based Image Editingcited by 7
  27. 2023A High-Quality Robust Diffusion Framework for Corrupted Datasetcited by 6
  28. 2024PID: Prompt-Independent Data Protection Against Latent Diffusion Modelscited by 6
  29. 2025SITA: Structurally Imperceptible and Transferable Adversarial Attacks for Stylized Image Generationcited by 6
  30. 2023My Art My Choice: Adversarial Protection Against Unruly AIcited by 5
  31. 2024Exploring Adversarial Attacks against Latent Diffusion Model from the Perspective of Adversarial Transferabilitycited by 5
  32. 2024Real-time Identity Defenses against Malicious Personalization of Diffusion Modelscited by 5
  33. 2025ArtistAuditor: Auditing Artist Style Pirate in Text-to-Image Generation Modelscited by 5
  34. 2025BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editingcited by 5
  35. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Modelscited by 5
  36. 2024Rethinking and Red-Teaming Protective Perturbation in Personalized Diffusion Modelscited by 4
  37. 2025GuardDoor: Safeguarding Against Malicious Diffusion Editing via Protective Backdoorscited by 4
  38. 2025A Comprehensive Survey on Visual Concept Mining in Text-to-image Diffusion Modelscited by 4

50 most cited of 114 All 114 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models
  2. 2024Disrupting Diffusion: Token-Level Attention Erasure Attack against Diffusion-based Customization
  3. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Models
  4. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models
  5. 2026Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation
  6. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attacks
  7. 2025Towards Safe Synthetic Image Generation On the Web: A Multimodal Robust NSFW Defense and Million Scale Dataset
  8. 2024Dark Miner: Defend against undesirable generation for text-to-image diffusion models