{"id":"1b0d9eea-a479-4165-be54-77cc6f708207","arxiv_id":"2607.27292","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"VETO's attention-entropy cloak cuts FLUX.2 human-judged edit success to as low as 1.33%, and VetoBench adds 300 open/closed-frame examples for evaluating such protections.","lead":"Adding a nearly invisible pattern to a photo can stop modern AI editors like FLUX.2 from recontextualizing the person in it, by flattening the attention the editor pays to the source image. The paper also introduces VetoBench, a 300-example benchmark that tests these protections on both small local edits and full scene recontextualizations.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Core threat model excludes trivial preprocessing: JPEG re-encode at q≈90 restores FLUX.2 edit success from 3.33% to 70.33% (Table 5), so VETO's headline protection holds only against an attacker who consumes the exact protected tensor.","rationale":"The reader's weakest assumption and my independent read converge on the same load-bearing point: VETO's measured protection depends on the protected image being consumed without preprocessing. Table 5 is not a peripheral robustness caveat; it exposes a free attacker action that returns edit success from 3.33% to 70.33% at the paper's chosen ε=4. This matters more than other secondary concerns (one-annotator human evaluation, missing artifacts, omitted recent baselines) because it directly determines whether the headline protection is meaningfully deployable. The effect sizes in the human evaluation are large enough that single-annotator noise cannot plausibly explain a 66%→1.33% drop, and the MLLM/human condition-level correlation (r=0.967) supports the ranking, so the evaluation fragility is not the central risk. The attention-entropy mechanism is well motivated and the ablations are internally consistent. The unresolved question is whether the threat model can be restricted to exact-tensor use without making the contribution's practical value conditional to the point of near-vacuity. Since the reader's verdict is already CONDITIONAL and explicitly flags this weakness, my concern does not move the verdict; it confirms that the condition is necessary. The concrete test above would settle whether the vulnerability is merely a missing EOT augmentation or a more fundamental limit of the entropy objective at low distortion.","tokens_in":25019,"tokens_out":4156,"duration_ms":41712,"concrete_test":"Take the VetoBench FLUX.2 evaluation at VETO's Pareto-selected ε=4. Apply standard JPEG compression with quality 90/75/50 (PIL/OpenCV default chroma subsampling) to the protected images before passing them to the editor; measure MLLM ESR for each quality. If ESR at quality 90 already exceeds ~50% (Table 5 suggests 70.33% under its JPEG setting), the protection is defeated by routine re-encoding. As a control, also run VETO optimized with stochastic JPEG augmentation (quality sampled ≥70) and compare the robustness-Pareto (ESR vs LPIPS) to the ε=12 augmented row; this shows whether the vulnerability can be closed at acceptable distortion or is inherent to the entropy objective.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—VETO reduces human-judged edit success to 1.33%/1.67% on FLUX.2—is established under the implicit threat model that the attacker feeds the protected image x+δ directly into the editor. That assumption is the hinge. In the paper's own robustness table (Table 5), a single standard JPEG re-encode applied before editing at the headline ε=4 operating point raises MLLM edit success on VetoBench from 3.33% (clean) to 70.33%; horizontal flips give 36.33% and crops 68.67%. EOT augmentation during optimization helps flips/crops but not JPEG under the tight budget (JPEG column remains 58.67–74.33% at ε=4); only at ε=12 with JPEG augmentation does the JPEG row drop to 9.67%, at LPIPS 0.32 / PSNR 27.78, i.e., a visibly stronger perturbation. An attacker who downloads a shared image can re-encode to JPEG at zero cost; there is no requirement in the stated threat model that the exact pixel tensor be preserved. Thus the practical protection rests on an unstated and easily violated preprocessing assumption. The paper acknowledges this in the conclusion ('Robustness to image transformations ... remains open'), but the acknowledgment does not resolve the concern: the central numbers in Tables 1–3 describe a scenario the attacker can trivially leave. The mechanism (attention entropy) is coherent and the in-scope results are internally consistent; the issue is that the boundary of the threat model is what carries the practical claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper addresses unauthorized editing of personal images by modern DiT-based unified editors (FLUX.2, Fibo-Edit). It proposes VETO, a per-image adversarial perturbation that maximizes the entropy of canvas-to-source and source-to-canvas attention blocks (Eq. 6), rather than attacking the encoder as in prior cloaking methods. It also introduces VetoBench, a 300-sample benchmark of closed-frame and open-frame edits across general, defamatory, and gore domains. The main experiments compare VETO with PhotoGuard and EditShield on three benchmarks under Pareto-selected perturbation budgets, reporting large reductions in MLLM- and human-judged edit success rates while maintaining lower LPIPS distortion, plus transfer experiments across FLUX.2 variants. The paper concludes that robustness to image transformations remains open.","tokens_in":25394,"tokens_out":8636,"duration_ms":86276,"significance":"If the empirical results hold, this is a meaningful step toward protecting images from modern editing models: it is the first defense I am aware of that targets the joint-attention pathway in unified DiT editors, and the proposed objective is conceptually clean and mechanistically motivated. The evaluation is thorough in several respects: fixed seeds and one output per source-instruction pair, all methods evaluated under the same PGD framework, Pareto-based budget selection that avoids a single arbitrary epsilon, baselines reimplemented under assumptions favorable to them, and a human study validating the MLLM judgment at the aggregate level. VetoBench is a useful resource for the community. The main caveat is that the practical protection claim depends on the attacker using the exact protected tensor; the paper's own robustness table shows that standard JPEG re-encoding restores most edit success. This does not invalidate the in-scope results, but it must be made explicit and addressed, or the contribution is mainly a proof-of-concept.","major_comments":[{"comment":"Threat-model boundary and robustness. The headline numbers, e.g. human-judged edit success of 1.33% on EditBench for FLUX.2 (Table 1), assume the attacker feeds x+delta directly into the editor. Table 5 shows this is not robust to a single JPEG re-encode: at epsilon=4, VETO MLLM ESR on VetoBench rises from 3.33% (clean) to 70.33%, and crops recover 68.67%. Since re-encoding is a zero-cost step in normal image sharing, the practical cost-raising property is not established. The conclusion states this remains open, but the abstract and introduction present the protection without this caveat. Please either scope the threat model explicitly to exact-tensor direct use and justify why that is the relevant model, or incorporate JPEG/EOT into the optimization and report the trade-off (the epsilon=12 JPEG-augmented row reaches 9.67% but at LPIPS 0.32/PSNR 27.78, a clearly visible perturbation). T","section":"Table 5; Conclusion; Introduction"},{"comment":"Model selection for hook configuration. The default hook configuration for Fibo-Edit (first eight double-stream blocks) is described as selected empirically. The same models and benchmarks are used in the evaluation. Please clarify what data was used for this selection. If VetoBench or the evaluation benchmarks were used to choose the configuration, the reported numbers are optimistically biased. At a minimum, report results for a fixed configuration across models or use a validation split. This matters because the ablation in Table 7 shows that the choice of hook location is far from inert (double-stream 3.33% vs single-stream 49.67% MLLM ESR).","section":"Supp. B.2; Table 7"},{"comment":"Human evaluation reliability. Human ESR is a central outcome and is used to validate the MLLM judge, but the study assigns one annotator per output and does not estimate inter-rater reliability. The aggregate correlations (Pearson r=0.967, Spearman rho=0.957) are encouraging, but they do not establish per-condition label reliability; annotator bias could shift individual cells. Please report agreement on a double-annotated subset, per-condition confidence intervals, or a sensitivity analysis. Note also that the MLLM received the original and edited scene descriptions while human annotators did not, so the agreement is measured across slightly different task definitions; this should be acknowledged or reconciled.","section":"Supp. E.5; Tables 1-3"}],"minor_comments":[{"comment":"The main text defines L_VETO for a single layer/head, while the actual objective averages over timesteps, layers, and heads (Supp. Eq. (6)). Please state the averaging in the main text to avoid confusion about what is optimized.","section":"VETO Section, Eq. (1)"},{"comment":"The method name is rendered inconsistently as both VETO and Veto. Pick one spelling and use it consistently.","section":"Throughout"},{"comment":"The qualitative difference between epsilon=4 and epsilon=12 is important for the robustness discussion. The epsilon=12 JPEG-augmented row is the only setting that resists JPEG, but at visibly higher distortion; this trade-off should be discussed in the main text, not only in the table.","section":"Table 5"},{"comment":"The threat-model section should explicitly cite the known sensitivity of image cloaking to preprocessing (PhotoGuard already identifies this as the Achilles heel of cloaking) and state how the present threat model relates to that finding.","section":"Introduction / Related Work"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern from the reader is valid and lands on a load-bearing point: the paper's practical claim collapses under a trivial JPEG re-encode, even though the in-scope experiments are internally consistent. I recommend major revision rather than rejection because the central technical idea and benchmark are useful, and the issues can be addressed by reframing the threat model, adding robustness results or EOT, and tightening the human-evaluation reporting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core of this paper is real. VETO is the first cloak aimed at the joint-attention mechanism in DiT-based unified editors, and the idea is clean: maximize entropy of canvas-reference attention blocks so the editor cannot form the token correspondences it needs to copy the source. The results under the stated threat model are strong and internally consistent -- human-judged edit success drops to single digits on FLUX.2, and the Pareto-fair comparison against PhotoGuard and EditShield is more careful than most prior work in this area. VetoBench is also a genuinely useful addition: the closed-frame/open-frame split is the right construct for evaluating modern editors, and the benchmark was curated independently of VETO's behavior. Transfer across FLUX.2 variants and Fibo-Edit, plus the ablations showing why the early double-stream block matters, all support the mechanism story. The soft spots are real but not disqualifying, and the paper is honest about most of them. The JPEG fragility in Table 5 is the load-bearing caveat: at the headline budget, a standard JPEG re-encode restores edit success from 3.33% to 70.33%. An attacker who downloads a shared image will almost certainly re-encode it at least once, so the practical protection is much weaker than the abstract implies. The paper acknowledges this in the conclusion, but the acknowledgment belongs in the abstract or contribution framing -- right now the headline numbers describe a scenario the attacker can trivially leave. That said, this is a known limitation of the whole cloaking line, not an inconsistency in the paper's own logic. The mechanism is coherent, the in-scope results are reproducible in design, and the robustness experiments are reported rather than hidden. Other concerns are minor by comparison: one annotator per output means no inter-rater reliability, the MLLM-human correlation is at the aggregate condition level, and the code and VetoBench data are promised but not yet released. The baselines are fairly adapted, and the paper even documents a choice favorable to EditShield. No derivation-level circularity; the only empirical configuration choice (first block for FLUX.2, first eight for Fibo-Edit) is disclosed and plausible. Bottom line: this is a serious piece of work that should get refereed. It advances the adversarial-cloaking program in a way that matters for current models, and it gives the community a benchmark that others can build on. My review would be conditional -- release artifacts, add inter-rater data, and reframe the robustness caveat as central rather than incidental -- but the conditional is a pathway, not a rejection.","headline":"A solid, well-communicated empirical contribution to image cloaking, but the practical protection only holds against an attacker who consumes the exact protected tensor; JPEG re-encoding breaks it.","tokens_in":727,"tokens_out":720,"would_cite":true,"duration_ms":17633,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"VETO protects images by flattening the attention an AI editor pays to them.","keywords":["image cloaking","adversarial perturbations","image editing","diffusion transformers","attention entropy","recontextualization","image protection","benchmark"],"falsifier":"Run an edit on a VETO-protected image that has been re-encoded once with JPEG compression at quality 70; the paper's Table 5 predicts MLLM edit success will jump from ~3% to ~70%, which would falsify the claim that VETO substantially protects images under real-world transmission.","tokens_in":24918,"feed_emoji":"🛡️","tokens_out":4011,"duration_ms":33512,"temperature":0.7,"pith_summary":"Modern image-editing models such as FLUX.2 read a source image through joint attention blocks, which lets them recontextualize people and objects into entirely new scenes. The paper claims that a small, nearly invisible perturbation to the source image—called VETO—can disrupt exactly this attention pathway, so that attempts to edit the protected image largely fail. On established benchmarks, VETO reduces human-judged edit success on FLUX.2 from about 66% to 1.33%, while distorting the image less than previous cloaks. The paper also introduces VetoBench, a 300-sample benchmark spanning both localized edits and full recontextualizations, to evaluate protection in settings that matter for reputational harm.","feed_headline":"Cloak scrambles editor attention, blocks 98% of edits","feed_subtitle":"Tiny pixel perturbation targets the attention mechanism of unified editors like FLUX.2, beating prior cloaks with less distortion.","key_machinery":"The central object is the attention entropy objective L_VETO = H(A^{c→x}) + H(A^{x→c}), evaluated on the first double-stream block of a multimodal DiT editor. Maximizing this entropy flattens the attention that canvas tokens pay to source tokens and vice versa, disrupting the token correspondences that support faithful editing. The optimization runs MI-FGSM with a perturbation budget ε, yielding a per-image cloak in under a minute.","core_discovery":"VETO is an anti-edit cloak that targets the internal attention mechanism of unified DiT-based editors. Instead of perturbing the encoder embedding as prior work does, VETO maximizes the entropy of the canvas-to-source and source-to-canvas attention blocks (Eq. 6), flattening the attention distribution and preventing the editor from reliably transferring source-image information into the evolving output. Across FLUX.2 and Fibo-Edit, on EditBench, AnyEdit, and the new VetoBench, VETO consistently yields the strongest protection-fidelity trade-off, reducing human-judged edit success on FLUX.2 to 1.33–1.67% at a Pareto-selected budget with lower LPIPS distortion than PhotoGuard or EditShield. Th","pith_inferences":["If attention entropy is the right bottleneck, then any editor that relies on long-range token correspondence—not just image editors—might be similarly disrupted; the same objective could be adapted to protect against video or 3D model editing.","The JPEG vulnerability suggests a practical arms race: a simple re-encode by an attacker nullifies the cloak, so real-world deployment would need expectation-over-transformation or watermark-style redundancy to survive platform compression.","VetoBench's use of synthetic identities is a wise ethical choice, but it leaves open how well protection transfers to real photographs with different statistics; testing on real personal photos would be a natural next step."],"forward_implications":["If VETO holds up, an image owner can publish a cloaked version that resists unauthorized edits by current frontier editors without relying on the model provider.","The attention-entropy objective gives a targeted, model-internal interception point that encoder-level cloaks miss, and it transfers across fine-tuned and distilled variants of the same editor.","VetoBench provides a reproducible way to measure protection against recontextualization, not just localized edits, which is the regime most relevant to reputational abuse.","Because VETO is per-image and needs no model cooperation, it could be combined with other guardrails (e.g., detection) in a layered defense."],"fun_headline_variants":["Cloak targets attention to block AI scene recontextualization","VETO scrambles editor attention, halts FLUX.2 edits","Pixel cloak disrupts joint-attention to stop harmful edits","Anti-edit cloak beats prior defenses on contextual edits"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The cloak only works if the attacker feeds the protected image directly into the editing model without any preprocessing; a trivial JPEG re-encode, flip, or crop largely defeats it.","fun_headline_variants_meta":{"raw":{"variants":["Cloak targets attention to block AI scene recontextualization","VETO scrambles editor attention, halts FLUX.2 edits","Pixel cloak disrupts joint-attention to stop harmful edits","Anti-edit cloak beats prior defenses on contextual edits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000236,"raw_usage":{"total_tokens":1348,"prompt_tokens":757,"completion_tokens":591,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":501,"completion_tokens_details":{"reasoning_tokens":519}},"tokens_in":501,"tokens_out":591,"duration_ms":6012,"temperature":1.0,"reasoning_tokens":519,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T10:12:43.499620+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an edit on a VETO-protected image that has been re-encoded once with JPEG compression at quality 70; the paper's Table 5 predicts MLLM edit success will jump from ~3% to ~70%, which would falsify the claim that VETO substantially protects images under real-world transmission.","supporting_citations":[],"review_version":1}