{"id":"4014679a-ef92-48a7-aa7c-14b479eef459","arxiv_id":"2412.21061","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"BridgePure learns the inverse of black-box data protection from a small set of (unprotected, protected) pairs, effectively purifying protected datasets and restoring model performance.","lead":"A new attack called BridgePure shows that if an adversary can query a black-box data protection API with a small set of unprotected images, they can train a diffusion bridge model to strip the protection from an entire protected dataset. This undermines popular tools like Glaze and Mist, restoring model accuracy to near-original levels with as few as 500 to 1000 leaked pairs.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Main tables rely on pairs produced in the same protection run as D (Appendix B.2), a stronger leakage than the stated black-box query threat model for dataset-dependent attacks.","rationale":"The reader's weakest assumption identifies the same structural risk: the attack requires Da and D to be protected by the same transformation. My stress-test sharpens this into the specific experimental setup: the main tables generate protection jointly on D plus the reference set and then use reference-derived pairs, which is equivalent to giving the adversary pairs from the exact protection run applied to D. For protections whose per-image perturbation depends on the dataset being protected (EM, REM, and most other availability attacks in Table 1), a black-box query on Da alone would not produce that same transformation, so the trained bridge may not transfer to D'. The paper honestly acknowledges this in Appendix C.12 and provides EMC*, OPS*, and TAP* experiments using only Da; those results are encouraging but cover only three attacks and still show a gap for TAP* at 0.5K-1K leakage. This does not refute the central claim, because the paper's threat model explicitly assumes in-distribution Da, and for several protections (LSP, OPS, UC/UC-CLIP, Glaze, Mist) the transformation is applicable to unseen data. But it means the empirical scope of the headline claim is narrower than the nine-attack tables suggest, and the reported near-perfect restoration numbers should be read as upper bounds under a favorable leakage configuration. The secondary issue of selecting s and beta on the test set also inflates absolute numbers, but it is less load-bearing than the leakage-setup mismatch: even with honest hyperparameter selection, the attack could still work for the protections where P is dataset-independent or where the same-run leakage is realistic. A concrete way to settle the concern is the independent-query EM experiment described above; if it matches Table 1, the concern is resolved. Given the paper's partial evidence and clear threat-model statement, the appropriate verdict remains conditional on this check rather than accept or reject.","tokens_in":23571,"tokens_out":6185,"duration_ms":61525,"concrete_test":"For EM on CIFAR-10, generate D' = EM(D) with the paper's budget and implementation. Separately run the same EM algorithm on Da alone (e.g., 1,000 images from the reference set) to obtain pairs (Da, EM(Da)), train BridgePure on those pairs, and purify D'. Then compare the purified classifier accuracy to the BridgePure-1K row in Table 1 (93.73 for EM). If the independently-queried result falls substantially below the main-table number (e.g., by more than 10 points), the main configuration uses a stronger leakage than the threat model and the claim for dataset-dependent protections is not established. Repeat for REM and at least one of DC/GUE/NTGA for which no C.12 variant exists.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that querying a black-box protection API with a small unprotected set Da yields pairs that let BridgePure reverse protection on unseen data. For several evaluated attacks (EM, REM, DC, GUE, NTGA, and to a degree TAP), P is not a fixed per-image transformation: it is the result of an optimization over the specific dataset it protects. In the main experiments (Tables 1 and 2), Appendix B.2 states that protection is generated on the combination of the protection set and the reference set from which Da is sampled, and the paired data are taken from the protected reference set. The adversary therefore receives pairs generated by the same protection run as D, which is stronger than the Section 3 threat model where the adversary only has Da and queries P to obtain P(Da). If an adversary runs a dataset-dependent protection on Da alone, the transformation can differ from the one applied to D, so the learned bridge may not purify D'. Appendix C.12 provides weaker-setup variants for only three attacks (EMC*, OPS*, TAP*) and shows notably lower TAP* recovery at small leakage; no independent-query evaluation is given for the remaining six attacks in Table 1. Appendix C.10 already demonstrates sharp degradation under distribution shift, and dataset-dependent protection runs are a related form of mismatch. Thus the headline result that BridgePure 'almost fully restores' availability across the evaluated protections is only established under the stronger same-run leakage setup, not under the literal black-box query threat model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BridgePure, a purification method that trains a denoising diffusion bridge model (DDBM) on (unprotected, protected) image pairs obtained by querying a black-box data protection API with a small unprotected dataset Da. It claims that the resulting model can approximately invert the protection mechanism P on unseen protected data, restoring the accuracy of downstream classifiers to near-original levels and removing style-mimicry protection from artwork. The paper evaluates BridgePure against nine availability attacks on CIFAR-10/100, three attacks on ImageNet-Subset and WebFace-Subset, two label-agnostic attacks on Cars/Pets, and two style-mimicry protections (Glaze and Mist), comparing against prior purification baselines and augmentation-based defenses.","tokens_in":23835,"tokens_out":4256,"duration_ms":43888,"significance":"If the central claim holds, the paper identifies a practically important vulnerability: black-box data protection services can be undermined by an adversary who possesses a small amount of unprotected in-distribution data and can query the protection API. The paper is commendable for its breadth of experiments, including multiple datasets, attacks, and architectures, and for its transparent discussion of the leakage setup in Appendices B.2 and C.12. It also provides useful ablations on the leakage amount, hyperparameters s and beta, partial leakage, and protection mixtures. However, two issues currently limit the force of the headline claim: the main experiments use a stronger same-run leakage for several dataset-dependent attacks, and the reported results select hyperparameters using test accuracy. These are fixable with additional experiments or scoped claims, but they are load-bearing for the stated threat model.","major_comments":[{"comment":"The threat model in Section 3 states that the adversary queries P with Da alone to obtain paired data bDa. However, for dataset-dependent protections such as EM, REM, DC, GUE, NTGA, and TAP, the protection transformation is optimized on the dataset it protects, so querying P on Da alone may yield a different transformation than the one applied to D. The main experimental protocol (Appendix B.2) generates protection on the combination of the protection set and the reference set, and extracts pairs from the protected reference set, which is a same-run leakage that is strictly stronger than the stated black-box query assumption. Tables 1 and 2 therefore do not establish the claimed attack for these protections. Appendix C.12 provides independent-query variants for only EMC*, OPS*, and TAP*, and the TAP* results in Table 9 are materially lower than the corresponding entries in Table 1 (e.g., 80.20% vs 86.81% at 0.5K on CIFAR-10). The authors should either provide independent-query evaluations for all dataset-dependent attacks in the main tables, or explicitly scope the claims to the same-run leakage setting.","section":"Section 3, Appendix B.2, Appendix C.12, Tables 1 and 2"},{"comment":"The main results report 'BridgePure's best performance across four configurations: s in {0.33, 0.8} and beta in {0, 0.02}' (Section 5.1), and Section 5.4 states that the paper reports 'the best-performing BridgePure within a limited number of trials.' This is a post-hoc selection on test accuracy, which inflates the reported numbers and creates an unfair comparison with baselines that are not given the same selection procedure. The authors should either tune hyperparameters on a validation split derived from the leakage pairs, or report the results for all configurations and the selection rule. At minimum, the main tables should indicate which s and beta were used for each attack.","section":"Section 5.1, Section 5.4, Tables 1 and 3"},{"comment":"The style mimicry evaluation is entirely qualitative: Figures 7, 10, 11, and 12 are visual comparisons, and no quantitative metric (e.g., distance to the original style, LPIPS, or detection rate of protective patterns) is reported. The claim that BridgePure demonstrates 'superior purification performance' on style mimicry tasks therefore rests on visual inspection. A quantitative evaluation would strengthen this part of the paper, especially because the central contribution also covers generation tasks.","section":"Section 5.3, Appendix C.4"}],"minor_comments":[{"comment":"There is a typo in the first paragraph: 'BidgePure' should be 'BridgePure'.","section":"Appendix C.10"},{"comment":"Reference [16] has a garbled title: 'Witches' Brew: ial Scale Data Poisoning via Gradient Matching' should likely be 'Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching'.","section":"References"},{"comment":"The sentence 'Our results in this section reveal the worst-case damage caused by protection leakage by reporting the best-performing BridgePure' is confusing: reporting the best-performing configuration reveals the best-case for the adversary, not the worst-case. Please rephrase to avoid ambiguity.","section":"Section 5.4"},{"comment":"The first sentence, 'Note that our threat model assumes that the protection mechanism P can generate (unprotected, protected) pairs using only the additional data Da,' is misleading: in the threat model, the adversary generates pairs by querying P, rather than P generating pairs on its own. Please rephrase.","section":"Appendix C.12"},{"comment":"In Eq. (5), the conditioning variable is written as xT, but in the bridge setup xT is the fixed protected endpoint. Using x' instead of xT for the conditioning variable in s_theta and in the score notation would clarify the distinction between time index and data endpoint.","section":"Section 2.3, Eq. (5)"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and important problem, and the empirical scope is impressive. The main obstacle is the gap between the stated black-box query threat model and the same-run leakage used in the main experiments for dataset-dependent attacks; this is acknowledged in Appendix C.12 but not resolved for the majority of attacks. The test-set hyperparameter selection is a separate but significant methodological issue that should be corrected. I believe the claims are likely salvageable with additional independent-query experiments and a properly separated hyperparameter selection, and the paper would then be a valuable contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Honest take: this paper identifies a genuinely plausible vulnerability—protection leakage—and shows that a diffusion bridge model trained on a few (clean, protected) pairs can reverse a wide range of availability attacks and style protections. The empirical sweep is broad (14 attacks, five datasets, classification and mimicry) and the method consistently beats the baselines it compares to. I buy the core mechanism: if an adversary can obtain paired samples, learning an inverse map with DDBM is a natural and effective move. The partial-leakage and cross-protection experiments are thoughtful, and the paper is candid about several limitations (B.2, C.10, C.12).\n\nThe soft spots are real but not fatal. First, the main tables are generated under a leakage setup that is stronger than the threat model advertised in Section 3. For sample-wise, dataset-dependent attacks (EM, REM, DC, etc.), protecting D and Da together (Appendix B.2) gives the adversary pairs from the very run that produced D′. That is not the same as the adversary querying P with Da alone, where the transformation can differ. The paper only evaluates the literal independent-query setting for three attacks (EMC*, OPS*, TAP*), and TAP* recovery is visibly weaker at 0.5K leakage. So the headline 'almost fully restores availability across the evaluated protections' is established only for the same-run leakage model; the abstract slightly oversells it.\n\nSecond, the reported numbers are best-of-four per attack on the test set (s in {0.33,0.8}, beta in {0,0.02}). That is post-hoc selection; a real adversary would not know which configuration works best ahead of time. The paper acknowledges this in Section 5.4 ('worst-case damage'), but it means the magnitude of the improvement over baselines is optimistic. A validation split or a fixed configuration would make the claim much cleaner.\n\nThird, no code release is mentioned, and training each BridgePure model takes around 22 hours on one GPU; with 14 attacks and several datasets, independent verification is a heavy lift.\n\nWho is this for? Anyone building or relying on black-box protection APIs, and the ML security community more broadly. The core result is worth taking seriously, but the paper needs a revision that addresses the leakage-setup gap and the hyperparameter selection before I would treat the numbers as definitive. I would send it to serious reviewers—conditional accept, not desk reject.","headline":"A genuinely plausible attack on black-box data protection via protection leakage, with broad and mostly convincing experiments, but the headline numbers lean on a stronger leakage setup than advertised and on test-set hyperparameter tuning.","tokens_in":24374,"tokens_out":2631,"would_cite":true,"duration_ms":26949,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"With 500 unprotected image pairs, an adversary can break black-box data protection by training a diffusion bridge that inverts the protection on unseen data.","keywords":["availability attacks","unlearnable examples","data protection","diffusion bridge model","protection leakage","purification","style mimicry","black-box API"],"falsifier":"A concrete experiment: train BridgePure on leaked pairs from one distribution and purify protected images from a different distribution, for example CIFAR-100 pairs to purify CIFAR-10 or Monet paintings to purify a contemporary artist's artwork; if purified accuracy stays near the unprotected baseline, the distribution-match assumption is not load-bearing, while if it collapses as the paper's Appendix C.10 reports, the attack's reach is limited to adversaries with in-distribution leakage.","tokens_in":23370,"feed_emoji":"🛡️","tokens_out":7818,"duration_ms":78079,"temperature":0.7,"pith_summary":"Black-box data protection services let owners upload images and receive back perturbed versions that are supposed to be useless for training machine learning models. This paper argues those services leak enough information to be broken: an adversary who submits a small in-distribution set of unprotected images to the same service obtains (unprotected, protected) pairs, trains a diffusion bridge on those pairs, and thereby learns an approximate inverse of the protection. The resulting model, BridgePure, purifies unseen protected images so that classifiers trained on them recover near-original accuracy on nine availability attacks, and so that style-mimicry protections such as Glaze and Mist no longer cloak generated artwork. The paper concludes that protection leakage is a critical vulnerability of current black-box data protection and that practitioners need countermeasures.","feed_headline":"500 leaked pairs can undo black-box data protection","feed_subtitle":"A diffusion bridge trained on clean/protected pairs restores model accuracy on nine attacks.","key_machinery":"The load-bearing object is a denoising diffusion bridge model (DDBM): a stochastic process with fixed endpoints $x_0 = x$ and $x_T = x' = P(x)$, trained from scratch by minimizing the denoising score-matching loss on leaked pairs. At purification time the bridge is sampled through the time-reversed SDE or probability-flow ODE while conditioning on the protected endpoint, so each output is drawn from a learned conditional distribution $q_\\theta(x \\mid x')$ that approximately reverses $P$. Two pre-processing choices carry much of the practical gain: Gaussian perturbation $G_\\beta(x') = \\sqrt{1-\\beta}\\,x' + \\sqrt{\\beta}\\,z$ prevents overfitting when the leaked set is small, and the sampling randomness parameter $s \\in [0,1]$ trades fidelity against removal strength.","core_discovery":"On the paper's own terms, the discovery is that the protection mechanism $P$ can be approximately inverted from a small number of labelled pairs. Given access to a black-box API $P$ and a small dataset $D_a$ of unprotected in-distribution images, the adversary forms $\\hat{D}_a = \\{(x, P(x))\\}$, trains a denoising diffusion bridge model to transport between $x$ and $P(x)$, and then runs conditional sampling from the protected endpoint $x'$ to draw an approximation of $q_{\\text{data}}(x \\mid x')$. Experiments show this restores training availability almost completely: with 500 to 4,000 leaked pairs, BridgePure brings CIFAR-10 accuracy from attack-degraded levels back to roughly 93\\%--94\\% against nine attacks, outperforming adversarial training, D-VAE, AVATAR, and LE-JCDP, and it beats DiffPure on ImageNet and WebFace subsets. On style mimicry, 5 to 10 leaked paintings suffice for BridgePure to remove Glaze and Mist protection cloaks from fine-tuning data for Stable Diffusion while preserving brushstrokes. The paper also reports that 500 leaked pairs are more damaging than diluting a protected dataset with 4,000 unprotected images.","pith_inferences":["Editorial inference: the same paired-query attack should apply to any deterministic, queryable per-sample protection, so APIs should randomize or authenticate before returning protected versions; the effectiveness of such a countermeasure is directly measurable by running BridgePure against it.","Editorial inference: the strong dependence on distribution match suggests an adversarial data owner could defend by making the public or leaked portion of their data distributionally distinct from the protected portion, for example time-shifted or style-shifted.","Editorial inference: BridgePure learns a per-protection inverse, so mixing multiple mechanisms may raise the required leakage; the paper's mixture experiment indicates that mixing alone still does not stop a moderate number of pairs.","Editorial inference: because the bridge is trained from scratch, the attack's cost is dominated by training time, so future protections should be evaluated not only against pre-trained diffusion purifiers but against adversaries who can train a small bridge on their own leaked pairs."],"forward_implications":["If the paper is right, a black-box protection API is itself a bypass: anyone who can query it with a few hundred in-distribution images can undo protection on much larger unseen datasets.","Models trained on BridgePure-purified data regain near-original accuracy, so availability attacks offer little protection once any unprotected sample from the same distribution has leaked.","Style protections that work by cloaking fine-tuning data can be neutralized with as few as 5--10 leaked paintings, without pre-training a large diffusion model.","Because 500 leaked pairs outperform 4,000 diluted unprotected images, the risk is not mere data contamination but explicit inversion of the protection mechanism.","Partial leakage is enough to target specific classes: a handful of pairs per class can bring that class's accuracy above the unprotected baseline."],"supporting_citations":[{"why":"Supplies the denoising diffusion bridge model that BridgePure trains from scratch on leaked (unprotected, protected) pairs.","marker":"[76]"},{"why":"Defines the Glaze style-mimicry protection whose black-box API is queried to form leaked pairs in the generation experiments.","marker":"[56]"},{"why":"Defines the Mist style-mimicry protection used as a second target in the style-mimicry purification experiments.","marker":"[32]"},{"why":"Defines unlearnable examples and the EM availability attack, one of the nine attacks purified in the main classification tables.","marker":"[24]"},{"why":"Defines the TAP attack, a key availability attack that is harder to purify and appears throughout the main experiments.","marker":"[14]"},{"why":"Provides the DiffPure baseline, a pre-trained diffusion purification method that BridgePure must beat with far fewer data.","marker":"[42]"},{"why":"Provides the AVATAR baseline, which purifies protected data using a diffusion model pre-trained on unprotected data.","marker":"[9]"},{"why":"Provides the LE-JCDP baseline, which fine-tunes a diffusion model on additional data and is a strong purification competitor.","marker":"[25]"},{"why":"Provides the D-VAE baseline, a variational-autoencoder purification method that requires no additional data.","marker":"[72]"},{"why":"Supplies the style-mimicry fine-tuning pipeline and the prior finding that many purification methods fail on protected artwork, the setup BridgePure is tested in.","marker":"[21]"}],"fun_headline_variants":["Diffusion bridge strips black-box data protection","500 pairs break black-box data protection","Small leak defeats black-box data protection","BridgePure: Minimal leakage topples data protection","Black-box protection falls to tiny data leak"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument requires that the adversary's small unprotected dataset come from the same distribution as the protected data and that the protection service apply the same transformation to both; when either fails, the paper's own cross-distribution tests show purification degrades sharply.","fun_headline_variants_meta":{"raw":{"variants":["Diffusion bridge strips black-box data protection","500 pairs break black-box data protection","Small leak defeats black-box data protection","BridgePure: Minimal leakage topples data protection","Black-box protection falls to tiny data leak"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000574,"raw_usage":{"total_tokens":2732,"prompt_tokens":986,"completion_tokens":1746,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":602,"completion_tokens_details":{"reasoning_tokens":1681}},"tokens_in":602,"tokens_out":1746,"duration_ms":13254,"temperature":1.0,"reasoning_tokens":1681,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:02:37.359967+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete experiment: train BridgePure on leaked pairs from one distribution and purify protected images from a different distribution, for example CIFAR-100 pairs to purify CIFAR-10 or Monet paintings to purify a contemporary artist's artwork; if purified accuracy stays near the unprotected baseline, the distribution-match assumption is not load-bearing, while if it collapses as the paper's Appendix C.10 reports, the attack's reach is limited to adversaries with in-distribution leakage.","supporting_citations":[{"cited_title":"Denoising Diffusion Bridge Models","cited_arxiv_id":null,"evidence_quote":"Supplies the denoising diffusion bridge model that BridgePure trains from scratch on leaked (unprotected, protected) pairs."},{"cited_title":"Glaze: Protecting artists from style mimicry by{Text-to-Image} models","cited_arxiv_id":null,"evidence_quote":"Defines the Glaze style-mimicry protection whose black-box API is queried to form leaked pairs in the generation experiments."},{"cited_title":"Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples","cited_arxiv_id":null,"evidence_quote":"Defines the Mist style-mimicry protection used as a second target in the style-mimicry purification experiments."},{"cited_title":"Unlearnable Examples: Making Personal Data Unexploitable","cited_arxiv_id":null,"evidence_quote":"Defines unlearnable examples and the EM availability attack, one of the nine attacks purified in the main classification tables."},{"cited_title":"Adversarial examples makestrongpoisons","cited_arxiv_id":null,"evidence_quote":"Defines the TAP attack, a key availability attack that is harder to purify and appears throughout the main experiments."},{"cited_title":"Diffusion models for adversarial purification","cited_arxiv_id":null,"evidence_quote":"Provides the DiffPure baseline, a pre-trained diffusion purification method that BridgePure must beat with far fewer data."},{"cited_title":"The devil’s advocate: Shattering the illusion of unex- ploitable data using diffusion models","cited_arxiv_id":null,"evidence_quote":"Provides the AVATAR baseline, which purifies protected data using a diffusion model pre-trained on unprotected data."},{"cited_title":"Unlearnable examples give a false sense of security: Piercing through unexploitable data with learnable examples","cited_arxiv_id":null,"evidence_quote":"Provides the LE-JCDP baseline, which fine-tunes a diffusion model on additional data and is a strong purification competitor."},{"cited_title":"Purify Unlearnable Examples via Rate-Constrained Variational Autoencoders","cited_arxiv_id":null,"evidence_quote":"Provides the D-VAE baseline, a variational-autoencoder purification method that requires no additional data."}],"review_version":1}