# Protective Perturbations Must Survive the Resize: Scale-Robust Image Immunization against Malicious Editing

arXiv: https://arxiv.org/abs/2610.07464 · HTML: https://mlsanity.com/paper/2610.07464/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models.
- Builds on 11 of its 38 references that are in the map.
- First posted on arXiv 5 Oct 2026.

## Placed in

- Diffusion models / [Robustness, privacy and adversarial aspects](https://mlsanity.com/diffusion/robustness-privacy-and-adversarial-aspects/)

## Builds on (most cited first, 11 of 11)

- [Qwen-Image Technical Report](https://mlsanity.com/paper/2508.02324/) (2025)
- [FLUX.1 Kontext: Flow Matching for In-Context Image Generation and Editing in Latent Space](https://mlsanity.com/paper/2506.15742/) (2025)
- [Diffusion Models for Adversarial Purification](https://mlsanity.com/paper/2205.07460/) (2022)
- [Mist: Towards Improved Adversarial Examples for Diffusion Models](https://mlsanity.com/paper/2305.12683/) (2023)
- [DeContext as Defense: Safe Image Editing in Diffusion Transformers](https://mlsanity.com/paper/2512.16625/) (2025)
- [My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swapping](https://mlsanity.com/paper/2505.15336/) (2025)
- [Towards Transferable Defense Against Malicious Image Edits](https://mlsanity.com/paper/2512.14341/) (2025)
- [Purify Once, Edit Freely: Breaking Image Protections under Model Mismatch](https://mlsanity.com/paper/2603.13028/) (2026)
- [Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecycle](https://mlsanity.com/paper/2608.04314/) (2026)
- [Towards Robust Protective Perturbation against DeepFake Face Swapping](https://mlsanity.com/paper/2512.07228/) (2025)
- [Do Protective Perturbations Really Protect Portrait Privacy under Real-world Image Transformations?](https://mlsanity.com/paper/2604.23688/) (2026)

## Abstract (arXiv)

While instruction-guided editors built on diffusion transformers can turn a personal photo into a convincing forgery with a single sentence, protective perturbations aim to make such edits fail before the photo is ever shared. The threat is most acute for the photos people actually share, which have 10 megapixels or more and which current editors first downscale by a factor that the owner does not know. Existing protections are computed at one resolution or averaged over random scales, and they lose most of their effect once the photo is downscaled. They implicitly assume that the editor sees the scale for which they were optimized, or that protecting the average scale protects every scale. We propose SRIM, a protection that remains effective at every scale an editor may use, without knowing its preprocessing and at the same computational cost as standard expectation over transformation. SRIM covers the range of scales implied by the photo size with anchor scales and spends each optimization step on the scale where the protection is currently weakest. A spectral analysis shows that this worst-case protection degrades only logarithmically with the width of the range, a value that averaging over scales cannot reach. Extensive experiments on full-resolution photos and popular instruction-guided editors validate that SRIM gives the strongest protection, outperforming existing methods even with a quarter of their ℓ_∞ budget, remaining the strongest under input purification.