Researchers demonstrate circumvention of digital image protection systems
Researchers at Virginia Tech found that widely-used image protection tools designed to prevent AI copying and deepfake creation can be bypassed using off-the-shelf generative AI models with simple text prompts. The team demonstrated the vulnerability across six different protection schemes, showing that attackers need no specialized knowledge or custom software.
What happened
A research team led by Dr. Bimal Viswanath at Virginia Tech demonstrated that protective perturbations added to digital images by tools like Glaze and PhotoGuard can be bypassed using Stable Diffusion 3 with a simple text prompt saying 'Denoise the image.'
The team conducted eight tests against six different protection schemes, including defenses designed to block AI learning, noise embedded in AI model processing layers, and robust systems designed to survive downstream editing. All six protection schemes were defeated.
Reported impact
The researchers found that attackers need no custom software, specialized knowledge, server time, or insider understanding of the protection tools. The vulnerability enables fraud, deepfake creation, and unauthorized artistic style mimicry more easily than previously possible.
Viswanath stated that 'there is currently no foolproof, mathematically guaranteed way for users to protect publicly posted images against an adversary using off-the-shelf GenAI models,' highlighting that existing protection methods may give users a false sense of security.
Index analysis
Since 2023, thousands of photographers and illustrators had adopted image protection tools as standard practice before posting online, with one 2023 study reporting style mimicry protection rates above 92 percent. The protective perturbations are pixel-level changes invisible to human eyes but designed to scramble content for AI models.
The attack uses a general-purpose method that outperforms existing specialized attacks at circumventing protections while preserving image utility for adversaries. The research was presented at the fourth IEEE Conference on Secure and Trustworthy Machine Learning in Munich, Germany.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.