# Do Protective Perturbations Really Protect Portrait Privacy under Real-world Image Transformations? arXiv: https://arxiv.org/abs/2604.23688 ยท HTML: https://mlsanity.com/paper/2604.23688/ ## Key facts - Cited by 1 papers in the map (data through 14 Oct 2026). - Builds on 29 of its 47 references that are in the map. - First posted on arXiv 26 Apr 2026. ## Builds on (most cited first, 29 of 29) - [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018) - [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017) - [InstructPix2Pix: Learning to Follow Image Editing Instructions](https://mlsanity.com/paper/2211.09800/) (2022) - [ESRGAN: Enhanced Super-Resolution Generative Adversarial Networks](https://mlsanity.com/paper/1809.00219/) (2018) - [Qwen-Image Technical Report](https://mlsanity.com/paper/2508.02324/) (2025) - [StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translation](https://mlsanity.com/paper/1711.09020/) (2017) - [Real-ESRGAN: Training Real-World Blind Super-Resolution with Pure Synthetic Data](https://mlsanity.com/paper/2107.10833/) (2021) - [A Lip Sync Expert Is All You Need for Speech to Lip Generation In The Wild](https://mlsanity.com/paper/2008.10010/) (2020) - [BiSeNet: Bilateral Segmentation Network for Real-time Semantic Segmentation](https://mlsanity.com/paper/1808.00897/) (2018) - [Sora: A Review on Background, Technology, Limitations, and Opportunities of Large Vision Models](https://mlsanity.com/paper/2402.17177/) (2024) - [Towards Real-World Blind Face Restoration with Generative Facial Prior](https://mlsanity.com/paper/2101.04061/) (2021) - [Hierarchical Cross-Modal Talking Face Generationwith Dynamic Pixel-Wise Loss](https://mlsanity.com/paper/1905.03820/) (2019) - [SimSwap: An Efficient Framework For High Fidelity Face Swapping](https://mlsanity.com/paper/2106.06340/) (2021) - [Hallo: Hierarchical Audio-Driven Visual Synthesis for Portrait Image Animation](https://mlsanity.com/paper/2406.08801/) (2024) - [Raising the Cost of Malicious AI-Powered Image Editing](https://mlsanity.com/paper/2302.06588/) (2023) - [Loopy: Taming Audio-Driven Portrait Avatar with Long-Term Motion Dependency](https://mlsanity.com/paper/2409.02634/) (2024) - [Towards Automatic Face-to-Face Translation](https://mlsanity.com/paper/2003.00418/) (2020) - [Mist: Towards Improved Adversarial Examples for Diffusion Models](https://mlsanity.com/paper/2305.12683/) (2023) - [Toward effective protection against diffusion based mimicry through score distillation](https://mlsanity.com/paper/2311.12832/) (2023) - [Ditto: Motion-Space Diffusion for Controllable Realtime Talking Head Synthesis](https://mlsanity.com/paper/2411.19509/) (2024) - [Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbations](https://mlsanity.com/paper/2206.00477/) (2022) - [Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?](https://mlsanity.com/paper/2312.00084/) (2023) - [Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing](https://mlsanity.com/paper/2411.16832/) (2024) - [Fine-structure Preserved Real-world Image Super-resolution via Transfer VAE Training](https://mlsanity.com/paper/2507.20291/) (2025) - [Efficient Face Super-Resolution via Wavelet-based Feature Enhancement Network](https://mlsanity.com/paper/2407.19768/) (2024) - [A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authentication](https://mlsanity.com/paper/2407.10575/) (2024) - [Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain](https://mlsanity.com/paper/2505.01267/) (2025) - [Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generation](https://mlsanity.com/paper/2506.01591/) (2025) - [Efficient and Robust Video Defense Framework against 3D-field Personalized Talking Face](https://mlsanity.com/paper/2512.21019/) (2025) ## Built on by (most cited first, 1 of 1) - [Protective Perturbations Must Survive the Resize: Scale-Robust Image Immunization against Malicious Editing](https://mlsanity.com/paper/2610.07464/) (2026) ## Abstract (arXiv) Proactive defense methods protect portrait images from unauthorized editing or talking face generation (TFG) by introducing pixel-level protective perturbations, and have attracted increasing attention for privacy protection. In real-world use, images inevitably undergo sequences of benign operations during display and dissemination, such as resizing and color compression, which directly alter pixel values. Existing studies and robustness defenses mainly examine individual transformations in isolation, while sequentially composed transformations remain underexplored. To address this gap, we systematically evaluate whether representative proactive defenses against unauthorized image editing using GANs and diffusion models, as well as talking face generation, remain effective under sequential image transformations. The evaluated methods span general-purpose and portrait-specific defenses and are assessed qualitatively and quantitatively. Experimental results show that pixel-level perturbation-based defenses struggle to withstand sequences of common image transformations, posing a risk of failure in real-world applications. To further demonstrate that this vulnerability can be exploited at low cost, we introduce Transformation-Induced Purification via Region-wise Super-Resolution (TIP-RSR), a simple training-free framework combining sequential image transformations with off-the-shelf restoration models. TIP-RSR efficiently purifies protective perturbations while preserving image fidelity and requiring substantially less computation than diffusion-based purification methods. These findings expose a practical vulnerability in current proactive portrait defenses and highlight the need to account for sequential real-world transformations when designing future protection mechanisms. Our code is publicly available at https://github.com/Richen7418/TIP-RSR.