{"id":"2d4289ad-926f-475d-aabc-ca2ee01993d3","arxiv_id":"2508.06325","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"ATP embeds a fragile authorization message in the frequency domain of a protected photo so that any purification attempt corrupts the message and triggers rejection by the generation service.","lead":"This paper introduces Anti-Tamper Perturbation (ATP), a way to protect personal photos from being used to generate fake images by adding a hidden verification message that breaks when someone cleans the photo. If the message is broken, the image generation service can reject the request, catching attackers who try to bypass protection.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"100% PSR depends on the secret mask/block-size assumption; the paper's own adaptive attack shows PSR 0.33 under full knowledge, and the threshold justification is empirical only.","rationale":"The reader's weakest assumption correctly identifies mask secrecy and the empirically fitted threshold. My concern sharpens this: the 100% PSR claim is not a robustness guarantee but a conditional statement about an attacker who cannot perturb the image after purification. The paper explicitly scopes out local generation but does not scope out adaptive attacks against the verification oracle. Since the threat model allows the attacker to submit images to the public API, any attacker who can craft a purified image that still passes verification defeats the defense. The search-space argument ignores that the attacker does not need to recover the exact mask; they only need to avoid corrupting the authorization message below the threshold. A surrogate-model attack is the natural test. The recommendation remains CONDITIONAL with the same direction as the reader, because the mechanism is coherent and the empirical support is broad; a single decisive test (adaptive black-box attack) would settle whether the main claim holds.","tokens_in":18376,"tokens_out":1283,"duration_ms":13687,"concrete_test":"Implement an attacker who has black-box access to the verification oracle: given an image, the oracle returns accept/reject, and the attacker can submit many purified images. The attacker applies purification to a protected image and then optimizes a small perturbation (e.g., via PGD on a surrogate model that predicts Bit-error) to drive Bit-error back below threshold while keeping the purified image visually similar to the purified version. If the attacker can achieve PSR below 1.0, the 100% claim fails without requiring mask knowledge.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim—100% protection success against all purification-based attacks—rests on the authorization Bit-error exceeding 3/32 after purification. The paper provides no guarantee of this; it is only demonstrated for a few purification intensities in Figure 6, with a threshold chosen post hoc from the observed distributions (Appendix A.3). The mechanism is a fragile watermark, not a tamper-evident cryptographic check: nothing prevents an attacker who knows the mask and block size from relocating or re-embedding the authorization message after purification. The paper's own adaptive attack (Section 4, 'Protection Performance Under Adaptive Attacks') confirms this: with full knowledge of mask and BDCT hyperparameters, PSR drops to 0.33. The defense therefore does not verify authentication in the cryptographic sense; it only detects incidental corruption of a secret pattern. The search-space argument (C(393216,786432) ≈ 2^786414) is inapplicable to real adaptive attackers, who need not brute-force the mask: standard attacks (e.g., training a surrogate extractor, or optimizing images to preserve the message while removing the protection) operate without enumerating the mask. Thus the headline 100% figure is conditional on an unrealistically strong secrecy assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes Anti-Tamper Perturbation (ATP), a defense against purification-based bypass of protection perturbations in personalized image generation. ATP combines a protection perturbation (from existing methods such as Anti-DB, AdvDM, CAAT, and MetaCloak) with a fragile authorization perturbation that embeds a 32-bit message in the Block-DCT frequency domain. A random binary mask separates the two perturbations in the frequency domain, and an improved frequency-domain PGD (Algorithm 1) is introduced to preserve mask guidance. The service provider checks the extracted authorization message when a user submits images; a bit-error above a threshold triggers rejection. Experiments on CelebA-HQ and VGGFace2 with four protection baselines and several purification methods report a 100% Protection Success Rate under purification, while the adaptive-attack evaluation shows the rate drops to 0.33 when the attacker knows both the mask and BDCT hyperparameters.","tokens_in":18687,"tokens_out":8233,"duration_ms":98905,"significance":"If the claims held at face value, ATP would be a practically important defense-in-depth for online image-generation services. The paper's strengths are real: it identifies a clear failure mode (purification) and a plausible system-level response (service-side verification); it integrates with four existing protection algorithms; the ablation in Table 3 supports the internal mechanism (BDCT, improved PGD, and mask guidance each reduce bit-error); and the authors release code and test generalization to another diffusion model and personalization method. The contribution, however, is a fragile secret watermark rather than a tamper-evident cryptographic check. The headline 100% PSR is contingent on a bit-error threshold selected post hoc on the evaluation distributions and on the secrecy of the mask and block size; the paper's own adaptive attack demonstrates a large drop under full knowledge. These caveats substantially temper the significance, but the proposed frequency-domain mask-guided perturbation mechanism is still a useful building block for service-side protection.","major_comments":[{"comment":"The 100% Protection Success Rate under purification is obtained with a Bit-error threshold of 3/32 that, according to Appendix A.3, is selected after inspecting the bit-error distributions of the clean and purified evaluation images (Figure 9). Because the threshold is chosen on the same data used to report the PSR, the headline result is not a predictive claim about unseen purification methods or intensities. Figure 6 only demonstrates sensitivity for four purification types at selected intensities and for Anti-DB on CelebA-HQ (with the VGGFace2 variant in Figure 15), so it does not establish that any purification an attacker might apply will push the bit-error above 3/32. Please fix the threshold on a development set, report clean-versus-purified margins for all four baselines and both datasets, and either provide a coverage analysis or soften the 'reliably detects various purifications' claim.","section":"§4, Figure 3 and Appendix A.3"},{"comment":"The full-knowledge adaptive attack reduces the PSR to 0.33, meaning the authorization check fails for a nontrivial fraction of subjects even though the attacker was only applying rounding-based purification. This exposes that the mechanism is a secret fragile watermark rather than a tamper-evident check. The following search-space argument (C(393216,786432) ≈ 2^786414) is not a valid defense: a real adaptive attacker need not enumerate the mask; they can estimate it from protected/clean pairs, train a surrogate extractor, or directly optimize the purified image to keep the bit-error below threshold while removing the protection perturbation. The paper should either present an explicit adversarial model excluding full knowledge, or report the 100% PSR claim as conditional on that exclusion, alongside the 0.33 failure rate.","section":"§4, 'Protection Performance Under Adaptive Attacks'"},{"comment":"The threat model assumes attackers submit purified images to the service provider and explicitly excludes local generation. This is a legitimate scoping, but it means the abstract's sentence 'providing a robust solution for protecting individuals' portrait rights and privacy' overstates the result: for an attacker who runs DreamBooth locally, the method degrades to the underlying protection perturbation and the authorization mechanism is never checked (Section 5). I recommend stating this scope in the abstract and conclusion, and replacing 'tamper-proof' with terminology such as 'tamper-evident under a secret-mask assumption' throughout.","section":"Abstract, Section 1, and Section 5"}],"minor_comments":[{"comment":"The term 'Block Discrete Fourier Transformation (BDCT)' should be 'Block Discrete Cosine Transformation (BDCT)' to match Section 3 and the equations.","section":"Section 1, second paragraph"},{"comment":"The search-space expression 'C(393216,786432) ≈ 2^786414' is not meaningful as written; the number of balanced binary masks of length 786432 is C(786432,393216), whose log2 is about 786432 bits. Please correct the notation and exponent.","section":"Section 4, Adaptive Attacks"},{"comment":"The text reports that CLIP-IQAC and LIQE have the highest AUC but does not give the AUC values; including the numerical AUCs would make the metric selection reproducible.","section":"Appendix A.2, Figure 7"},{"comment":"The threshold-setting explanation ('when the occurrence of purification significantly impacts the distribution') should be replaced by a concrete procedure, such as choosing the threshold on a development set to minimize a detection error rate, with clean and purified bit-error statistics reported separately.","section":"Appendix A.3"},{"comment":"The bit-error threshold 3/32 is not shown in Figure 6; adding a horizontal reference line and tabulating the bit-error values would make the margin between clean and purified conditions visible.","section":"Section 4, 'Sensitivity to Purification'"}],"recommendation":"major_revision","confidential_remarks":"The adaptive-attack result (PSR 0.33) is the main risk to the paper's headline. I would invite a revision that reframes the claims as conditional on a secret mask and a fixed pre-registered threshold, and that adds a development-set evaluation. The technical core is sound enough to warrant another round rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read this one. The core idea is genuinely new: put a fragile steganographic authorization message in frequency coefficients disjoint from the adversarial protection perturbation, guided by a random binary mask, and use a frequency-domain PGD that respects the mask. The ablation story is solid—Table 3 and the appendix figures show the mask and improved PGD reduce bit-error by orders of magnitude. The integration with four existing protection methods and the generalization experiments to a different diffusion model and personalization method are real pluses. This is not a desk reject.\n\nThe soft spot is the headline: 100% protection success rate under purification is conditional on the mask and block size being secret. The authors' own adaptive attack shows that when an attacker knows both, PSR drops to 0.33. Their response—a combinatorial search-space argument—is weak. An adaptive attacker doesn't need to enumerate the mask; they can train a surrogate extractor or optimize the image to keep the message while removing the protection. The honest claim is: works against attackers who use standard purification and don't know the mask.\n\nSecond, the bit-error threshold (3/32) is fitted post hoc to the clean-vs-purified distributions. The paper says it's consistent across datasets and methods, but that's an empirical assertion for a handful of purification intensities, not a coverage argument. Error bars or a sensitivity analysis would help.\n\nThird, there's a terminology slip in the intro: 'Block Discrete Fourier Transformation' vs. the actual 'Block Discrete Cosine Transformation.' Minor but sloppy.\n\nThe frequency-domain sensitivity analysis in Appendix A.4 is descriptive, not a proof, but that's a minor concern. The mechanism is plausible.\n\nFor a colleague: this is a useful contribution to the protected-image literature, with the same fundamental limitation as most steganographic defenses—security depends on secret parameters. The paper is readable, the experiments are extensive, and the code is available. It deserves a serious referee, with two requests: scope the threat model carefully and replace the post-hoc threshold with a principled analysis.\n\nI'd cite it if I were working in this area; for a reading group it would generate a good discussion about what 'tamper-proof' can mean in this setting.","headline":"Genuinely useful new mechanism, but the 100% claim outruns the evidence and the secret-mask assumption is doing more work than the paper admits.","tokens_in":19167,"tokens_out":3088,"would_cite":true,"duration_ms":38045,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a fragile authorization watermark, embedded in the frequency domain alongside protection perturbation, makes purification-based forgery attacks detectable, achieving a 100% protection success rate in experiments.","keywords":["anti-tamper perturbation","forgery protection","purification attack","frequency-domain watermark","block discrete cosine transform","personalized image generation","tamper detection","diffusion model protection"],"falsifier":"Protect many images with the same mask and compare their frequency coefficients: if the mask can be recovered from a few protected images, the secrecy assumption fails. Alternatively, run the full adaptive attack with a known mask and block size and show that a purified image still decodes with bit-error at or below $3/32$ while producing a high-quality forgery.","tokens_in":18128,"feed_emoji":"🛡️","tokens_out":10485,"duration_ms":99213,"temperature":0.7,"pith_summary":"Online services that generate personalized images can be misused to create fake portraits, and the standard defense—embedding protective adversarial noise in the image—collapses when attackers first purify the image by resizing, compressing, or similar operations. This paper claims that protection can be made tamper-evident by embedding a fragile authorization message in the frequency domain alongside the protective noise: a secret binary mask assigns each block-DCT coefficient to either the message or the noise, so the noise does not erase the message, while purification corrupts it. When the decoded message's bit-error passes a threshold, the service provider rejects the generation request instead of producing a fake. In experiments with four existing protection algorithms on two face datasets, ATP reports a 100% protection success rate against purification-based forgery attacks. If correct, this converts purification from a bypass into a detectable anomaly, closing a known hole in image forgery defenses.","feed_headline":"Purified forgeries all rejected by a new frequency-domain watermark.","feed_subtitle":"Coupling protection noise with a fragile mask-guided message lets online image services reject tampered requests.","key_machinery":"The load-bearing mechanism is mask-guided blending in the frequency domain using the Block Discrete Cosine Transform (BDCT), which replaces the image with per-block frequency coefficients. A binary mask $M$ (sampled from Bernoulli($p=0.5$)) splits the block-DCT coefficients into authorization positions ($M=1$) and protection positions ($1-M$); a learned autoencoder embeds a 32-bit message into the authorization coefficients, and an improved frequency-domain PGD (Algorithm 1) updates only the protection coefficients by performing the sign and projection steps in the frequency domain. The block size ($16\\times16$) and the mask together keep the two perturbations from interfering, and the inverse transform distributes each coefficient over its whole block, giving purification sensitivity. Verification decodes the message and rejects the image when the bit-error exceeds $3/32$.","core_discovery":"ATP splits the perturbation into two parts that occupy disjoint regions of the block-DCT domain. The protection perturbation is the existing anti-forgery noise (from methods such as Anti-DB, AdvDM, CAAT, or MetaCloak), and the authorization perturbation is a 32-bit binary message hidden by a convolutional autoencoder. The paper's key algorithmic change is an improved frequency-domain PGD (Algorithm 1) that applies sign and projection operations on frequency coefficients rather than pixels, so the guiding mask is respected and the two perturbations do not interfere. Because the inverse block DCT spreads each coefficient across the pixels of its block, the authorization message is distributed throughout the image and is highly sensitive to purification. The central empirical claim is that under JPEG compression, resizing, and GridPure purification, ATP reaches a 100% Protection Success Rate: the corrupted message trips the verification threshold and the request is rejected, whereas each baseline protection algorithm without ATP suffers a drop in protection success.","pith_inferences":["The 100% success rate is conditional on the threat model where the attacker submits purified images to the provider; if the attacker can generate locally or strip the message without exceeding the bit-error threshold, the defense no longer applies.","The verification threshold and sensitivity are demonstrated on a few purification operations; the paper provides no proof that an arbitrary purification will always exceed the bit-error threshold, so coverage of the tamper-detection guarantee remains an open question.","Because the mask must be secret, a deployed system would need per-image or per-user mask rotation; one leaked mask would compromise every image protected under it.","The same fragile frequency-domain message design could be evaluated for detecting other tampering operations, such as cropping, inpainting, or adversarial modification."],"forward_implications":["Purification no longer bypasses protection at the API level: any request whose authorization message is corrupted is rejected.","Existing protection algorithms can gain tamper detection by swapping their pixel-space PGD for the frequency-domain PGD, as shown with Anti-DB, AdvDM, CAAT, and MetaCloak.","Without purification, ATP keeps protection quality comparable to the original algorithms, and the extra compute is small (about 0.38% more protection time, sub-millisecond encoding).","Attackers with only partial knowledge (mask or block size, but not both) still trigger verification failure.","Full knowledge of the mask and block size defeats the mechanism, so parameter secrecy is a deployment requirement."],"supporting_citations":[{"why":"Baseline protection algorithm (Anti-DB) that ATP adapts via the improved frequency-domain PGD.","marker":"[18]"},{"why":"Baseline protection algorithm (AdvDM), the first adversarial-example defense that ATP extends.","marker":"[19]"},{"why":"Baseline protection algorithm (CAAT) that ATP integrates, targeting cross-attention in diffusion models.","marker":"[31]"},{"why":"Baseline protection algorithm (MetaCloak) and the variant used in the adaptive-attack experiments.","marker":"[21]"},{"why":"GridPure, the advanced purification method ATP must detect.","marker":"[34]"},{"why":"Autoencoder-based message hiding design that the authorization perturbation network is built on.","marker":"[35]"},{"why":"FaceSigns, a semi-fragile watermark baseline compared for purification sensitivity.","marker":"[24]"},{"why":"Frequency-domain gradient masking that motivates the mask-guided PGD design.","marker":"[10]"},{"why":"Evidence that purification bypasses protection perturbations, which motivates the tamper-proof mechanism.","marker":"[13]"}],"fun_headline_variants":["Frequency-domain anti-tamper blocks purified forgeries","New perturbation resists purification attacks on images","ATP: dual perturbation defeats image purification bypass","Mask-guided frequency trick stops purified fake images","Anti-purification watermark for personal image protection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense assumes the binary mask (and the BDCT block size) remains secret; if an attacker knows both, the paper's adaptive attack shows the protection success rate drops from 100% to 0.33.","fun_headline_variants_meta":{"raw":{"variants":["Frequency-domain anti-tamper blocks purified forgeries","New perturbation resists purification attacks on images","ATP: dual perturbation defeats image purification bypass","Mask-guided frequency trick stops purified fake images","Anti-purification watermark for personal image protection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000638,"raw_usage":{"total_tokens":2935,"prompt_tokens":936,"completion_tokens":1999,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":552,"completion_tokens_details":{"reasoning_tokens":1931}},"tokens_in":552,"tokens_out":1999,"duration_ms":16671,"temperature":1.0,"reasoning_tokens":1931,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T04:12:18.493091+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Protect many images with the same mask and compare their frequency coefficients: if the mask can be recovered from a few protected images, the secrecy assumption fails. Alternatively, run the full adaptive attack with a known mask and block size and show that a purified image still decodes with bit-error at or below $3/32$ while producing a high-quality forgery.","supporting_citations":[{"cited_title":"Frank, and Kilian Q","cited_arxiv_id":null,"evidence_quote":"Frequency-domain gradient masking that motivates the mask-guided PGD design."},{"cited_title":"Tran, and Anh Tuan Tran","cited_arxiv_id":null,"evidence_quote":"Baseline protection algorithm (Anti-DB) that ATP adapts via the improved frequency-domain PGD."},{"cited_title":"Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples","cited_arxiv_id":null,"evidence_quote":"Baseline protection algorithm (AdvDM), the first adversarial-example defense that ATP extends."},{"cited_title":"Perturbing attention gives you more bang for the buck: Subtle imaging perturbations that efficiently fool customized diffusion models","cited_arxiv_id":null,"evidence_quote":"Baseline protection algorithm (CAAT) that ATP integrates, targeting cross-attention in diffusion models."},{"cited_title":"Metacloak: Preventing unauthorized subject-driven text-to-image diffusion-based synthesis via meta-learning","cited_arxiv_id":null,"evidence_quote":"Baseline protection algorithm (MetaCloak) and the variant used in the adaptive-attack experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"GridPure, the advanced purification method ATP must detect."},{"cited_title":"clear” and “origin","cited_arxiv_id":null,"evidence_quote":"Autoencoder-based message hiding design that the authorization perturbation network is built on."},{"cited_title":"McAuley, and Farinaz Koushanfar","cited_arxiv_id":null,"evidence_quote":"FaceSigns, a semi-fragile watermark baseline compared for purification sensitivity."}],"review_version":1}