TarPro: Targeted Protection against Malicious Image Editing
Not on the map. Why?
Abstract (arXiv)
The rapid advancement of image editing techniques has raised concerns about their misuse for generating Not-Safe-for-Work (NSFW) content. This necessitates a targeted protection mechanism that blocks malicious edits while preserving normal editability. However, existing protection methods fail to achieve this balance, as they indiscriminately disrupt all edits while still allowing some harmful content to be generated. To address this, we propose TarPro, a targeted protection framework that prevents malicious edits while maintaining benign modifications. TarPro achieves this through a semantic-aware constraint that only disrupts malicious content and a lightweight perturbation generator that produces a more stable, imperceptible, and robust perturbation for image protection. Extensive experiments demonstrate that TarPro surpasses existing methods, achieving a high protection efficacy while ensuring minimal impact on normal edits. Our results highlight TarPro as a practical solution for secure and controlled image editing.
Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 51 of its 55 references that are in the map. First posted on arXiv 18 Mar 2025.
Builds on
51 of 55 references.
References · 51
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,503
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
- 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
- 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
- 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,614
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2022InstructPix2Pix: Learning to Follow Image Editing Instructionscited by 2,611
- 2022Prompt-to-Prompt Image Editing with Cross Attention Controlcited by 2,431
38 more
- 2016Adversarial examples in the physical worldcited by 1,769
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
- 2023MagicBrush: A Manually Annotated Dataset for Instruction-Guided Image Editingcited by 624
- 2017One pixel attack for fooling deep neural networkscited by 582
- 2023Erasing Concepts from Diffusion Modelscited by 539
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
- 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Modelscited by 513
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
- 2022Paint by Example: Exemplar-based Image Editing with Diffusion Modelscited by 489
- 2023Unified Concept Editing in Diffusion Modelscited by 388
- 2023Ablating Concepts in Text-to-Image Diffusion Modelscited by 317
- 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
- 2024HQ-Edit: A High-Quality Dataset for Instruction-based Image Editingcited by 193
- 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 168
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 167
- 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examplescited by 167
- 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 163
- 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 155
- 2023Editing Implicit Assumptions in Text-to-Image Diffusion Modelscited by 130
- 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Eraserscited by 120
- 2018SparseFool: a few pixels make a big differencecited by 94
- 2023Mist: Towards Improved Adversarial Examples for Diffusion Modelscited by 94
- 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 71
- 2023Self-Discovering Interpretable Diffusion Latent Directions for Responsible Text-to-Image Generationcited by 69
- 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradientcited by 69
- 2023Toward effective protection against diffusion based mimicry through score distillationcited by 65
- 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
- 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 58
- 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
- 2018Understanding and Enhancing the Transferability of Adversarial Examplescited by 41
- 2023Towards Safe Self-Distillation of Internet-Scale Text-to-Image Diffusion Modelscited by 41
- 2023ReFACT: Updating Text-to-Image Models by Editing the Text Encodercited by 32
- 2024Universal Prompt Optimizer for Safe Text-to-Image Generationcited by 28
- 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusioncited by 27
- 2023EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Modelscited by 27
- 2024IDProtector: An Adversarial Noise Encoder to Protect Against ID-Preserving Image Generationcited by 22
50 most cited of 51 All 51 (JSON)
Built on by
Citing papers per year: 2025: 2; 2026: 5.
7 papers.
- 2025Insert Anything: Image Insertion via In-Context Editing in DiTcited by 61
- 2026Is This Edit Correct? A Multi-Dimensional Benchmark for Reasoning-Aware Image Editingcited by 3
- 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 2
- 2025Moving Beyond Diffusion: Hierarchy-to-Hierarchy Autoregression for fMRI-to-Image Reconstructioncited by 0
- 2026NullEdit: Stealthy Image Protection via VLM Condition Redirectioncited by 0
- 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalitiescited by 0
- 2026Steering Fields: Adaptive Vector Fields for Safe Image Generation and Beyondcited by 0
- 2026Steering Fields: Adaptive Vector Fields for Safe Image Generation and Beyond30 Sep 2026
- 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities28 Aug 2026
- 2026NullEdit: Stealthy Image Protection via VLM Condition Redirection11 Aug 2026
- 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle5 Aug 2026
- 2026Is This Edit Correct? A Multi-Dimensional Benchmark for Reasoning-Aware Image Editing16 Apr 2026
- 2025Moving Beyond Diffusion: Hierarchy-to-Hierarchy Autoregression for fMRI-to-Image Reconstruction25 Oct 2025
- 2025Insert Anything: Image Insertion via In-Context Editing in DiT21 Apr 2025
Similar, not cited
Close in wording, no citation either way
- 2026Protective Perturbations Must Survive the Resize: Scale-Robust Image Immunization against Malicious Editing
- 2024Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Step
- 2025Is Perturbation-Based Image Protection Disruptive to Image Editing?
- 2024Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing
- 2026When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models
- 2026RedEdit: Agentic Red-Teaming of Image Safety Classifiers via MCTS-Guided Photo-Editing
- 2025VideoGuard: Protecting Video Content from Unauthorized Editing
- 2026When Recovery Matters: The Blind Spot of Surrogate Privacy in MLLM Editing