Pith. sign in

REVIEW 4 major objections 4 minor 19 references

A tiny grayscale perturbation flips AI colorizers into producing implausible colors, a proactive defense against unauthorized reuse.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A tiny, invisible perturbation added to a published grayscale image can force AI colorizers to produce content-wrong colors (blue apples), an effect this paper measures and optimizes with a new semantic color-plausibility score.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection SCNB is a real extension of the UE line — semantic color break instead of chroma suppression — but the headline numbers are entirely in units of the attack's own objective, so it needs human validation before I'd trust the effectiveness claim. the 4 major comments →

arxiv 2607.17610 v1 pith:FUCEHHAU submitted 2026-07-20 cs.CV cs.LG

Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors

Yuki Nii , Futa Waseda , Ching-Chun Chang , Isao Echizen This is my paper
classification cs.CV cs.LG
keywords adversarial examplescolorization defenseUncolorable Examplessemantic color priorsCIELAB colorGaussian mixture modelsproactive content protectionimage plausibility
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes Semantic Color Naturalness Breaker (SCNB), a proactive defense that adds an imperceptible perturbation to released grayscale images so that off-the-shelf AI colorizers produce content-inconsistent colors instead of plausible ones. It introduces Content-aware Color Distributional Distance (CaCDD), a ground-truth-free metric that measures how far a colorization deviates from semantic color priors learned per object/scene label. CaCDD is used both as the optimization objective and as the evaluation metric, and experiments show large CaCDD increases (e.g., +142% for BigColor at epsilon=32/255) that persist after JPEG compression and random cropping. If correct, publishers of grayscale media (manga panels, archival photos) get a one-time, publication-time defense that makes unauthorized colorized derivatives visibly implausible rather than merely desaturated.

Core claim

The central claim is that SCNB, unlike prior chroma-suppression defenses that fall into a 'gray-but-natural' failure mode, can deliberately drive colorization outputs toward colors that contradict the semantic content of the scene (e.g., blue apples, reddish vegetation), while keeping the released grayscale image visually unchanged. The key is CaCDD, which scores color plausibility by fitting per-label Gaussian Mixture Models over CIELAB chroma samples collected from automatically segmented semantic regions, then penalizing both out-of-distribution chroma (Mahalanobis distance) and hue-direction inconsistency relative to the nearest GMM mean. Optimizing this score via a perception-aware mask

What carries the argument

CaCDD, the Content-aware Color Distributional Distance, is a differentiable, ground-truth-free score built from label-conditioned GMM color priors in CIELAB a,b space. For each pixel it combines (i) a responsibility-weighted squared Mahalanobis distance to the semantic GMM, and (ii) a hue-direction inconsistency term that penalizes chroma directions far from the nearest GMM mean. It does the double duty of serving as the optimization objective for SCNB and as the evaluation metric for color plausibility.

Load-bearing premise

The load-bearing premise is that CaCDD's GMM-based color priors, built from ImageNet segmentations, actually capture what humans perceive as natural or unnatural color; if this metric diverges from human judgment, the reported defense effectiveness is inflated.

What would settle it

Run a human perceptual study where participants rate the plausibility of colorized images with high CaCDD scores (e.g., >3.0) against images with low scores; if participants find the high-CaCDD images acceptable or natural, the metric fails. Alternatively, train an adaptive colorizer that explicitly minimizes CaCDD while matching semantic priors and show it produces plausible outputs despite the perturbation.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If SCNB works as claimed, grayscale content providers can apply a one-time perturbation at publication, and any unauthorized AI colorization will look visibly wrong, reducing the resale value of pirated derivatives.
  • CaCDD offers a new evaluation axis for colorization systems: semantic plausibility rather than just fidelity or colorfulness, which could become a standard metric for colorization quality and adversarial defense.
  • The method is robust to common post-processing like JPEG compression and random resized cropping, meaning it can survive typical online sharing pipelines.
  • Ensemble crafting improves transferability to unseen colorizers, suggesting that the defense can be made practical against a moving set of AI tools.
  • Because the protection is in the released grayscale image itself, it requires no cooperation from the attacker or the colorization service.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's effectiveness claim hinges entirely on CaCDD's fidelity to human perception of 'content-inconsistent' colors; a human perceptual study or an adaptive attacker that optimizes for both plausibility and low CaCDD could expose a gap.
  • The semantic priors are built from ImageNet-style natural images, so applying SCNB to domains with different color statistics (e.g., anime, historical film stocks, medical imaging) may shift or weaken the defense; a domain-specific prior construction is a natural extension.
  • CaCDD as a metric could be repurposed as a content-aware 'color plausibility detector' for forensics, flagging colorized images whose color distribution deviates from learned semantic priors, independent of the defense use case.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SCNB, a proactive content-side defense that adds imperceptible perturbations to grayscale images so that downstream colorization models produce colors inconsistent with the scene content, rather than merely desaturated images. The method is an adversarial-example optimization that maximizes a newly introduced Content-aware Color Distributional Distance (CaCDD), defined from semantic color priors built with RAM tagging and Grounded-SAM segmentation over ImageNet. Experiments on three colorizers (DeOldify, BigColor, DDColor) report large CaCDD increases in white-box settings, some robustness to JPEG and random resized crop, and moderate black-box transferability when crafted with an ensemble. The authors position SCNB as an improvement over the chroma-suppression baseline PAChroma.

Significance. If the CaCDD metric truly tracks human judgments of semantic color unnaturalness, SCNB would be a meaningful step toward practical UE defenses and CaCDD itself would be a useful evaluation tool. The paper provides a transparent, reproducible recipe for constructing semantic color priors and a clear adversarial framework. However, the central evidence currently rests on a metric that is both the optimization objective and the evaluation criterion, so the claimed effectiveness is not independently established. The deferral of human studies and adaptive-attacker evaluation is a substantive gap that must be addressed before the practical claims can be accepted.

major comments (4)
  1. [§IV-B, Eq. (1); §IV-C, Eq. (7); Table I] The central effectiveness evidence is circular. SCNB maximizes CaCDD (Eq. 1) and CaCDD is defined in Eq. (7); Table I then reports CaCDD increases, e.g., BigColor 1.26→3.05 (+142%). In the white-box setting this increase is a direct consequence of the optimization objective. The paper defers human studies to Section VI, and Fig. 12 only shows weak correlation with CF/PSNR/SSIM, which does not validate CaCDD against human perception. Without an independent measure of semantic unnaturalness, the white-box results do not support the claim that colors are 'visibly implausible' rather than merely unusual under a GMM prior.
  2. [App. VII-A, Table III] The semantic priors are built from RAM/Grounded-SAM segmentations on ImageNet with multiple hand-set acceptance thresholds (area_min, score_min, text_min, bbox_IoU_min, etc.). None of these parameters is validated against human color plausibility. Maximizing CaCDD may exploit artifacts of the mask-selection process or the GMM fit (e.g., labels with poorly estimated priors) rather than producing colors that are genuinely inconsistent with the depicted object. A concrete test would be to run a human study on a sample of protected outputs, or to compare CaCDD-maximized outputs against an independent semantic-color-plausibility benchmark, and show that high CaCDD correlates with human-rated unnaturalness.
  3. [Table I, Table II] Transferability is one of the four UE requirements and a stated practical requirement, but the reported black-box gains are modest. In Table I, SCNB crafted on BigColor raises CaCDD by only +16% on DeOldify and +20% on DDColor. In Table II, ensemble crafting still leaves some unseen-target cells at +13%, +17%, and +26%. These numbers are consistent with the paper's admission of modest black-box gain, but they weaken the 'practical deployment in real-world content-sharing pipelines' claim. The paper should state a success threshold for transferability and discuss whether these gains are sufficient to deter unauthorized colorization, especially when the adversary can choose a colorizer that does not align with the surrogate set.
  4. [§V vs. App. X-A] The runtime is reported inconsistently: Section V states approximately 6 hours total and 10 minutes per image, while App. X-A states approximately 13 hours total and 20 minutes per image. Since the computational cost is used to justify practical deployment, this discrepancy must be resolved—there is likely an error in one of the two statements or a difference in experimental conditions that should be explained.
minor comments (4)
  1. [Abstract and §II] Typographical issue: 'Building onUncolorable Examples' appears in the abstract (missing space). Also 'oftenreactive' in the introduction should be 'often reactive'.
  2. [Fig. 4] The caption says 'Detectable/Undetectable' without defining what is being detected. It would help to clarify whether this refers to perturbation detection or color plausibility detection.
  3. [§IV-C, Eq. (5)] The hue-direction term uses a hard cap at angle π/2. The choice is not motivated; a brief explanation of why angles beyond 90 degrees are saturating would improve interpretability.
  4. [App. X-B] Table V reports 'mean over 80 runs: 40 images×2 seeds', but the main text says '40 ImageNet validation images with two random seeds' without clarifying whether the seeds affect the image selection or the perturbation optimization. Please state what the two seeds randomize.

Circularity Check

1 steps flagged

White-box CaCDD gains are the objective being optimized, so the headline effectiveness evidence is partly circular without external validation of the metric.

specific steps
  1. fitted input called prediction [Abstract; Section IV-B Eq. (1); Section V-A (Table I)]
    "We further introduce Content-aware Color Distributional Distance (CaCDD), a ground-truth-free, content-aware measure of color plausibility derived from semantic color priors, used both as the optimization objective of SCNB and as an evaluation metric. ... δ⋆ = arg max ∥δ∥∞≤ϵ CaCDD( G(xl +δ) ). ... SCNB, however, substantially increases CaCDD in the white-box setting across all three colorizers, e.g., BigColor 1.26→3.05 (+142%), showing that the outputs deviate from content-conditioned color priors."

    Eq. (1) explicitly defines the perturbation as maximizing CaCDD, and CaCDD is simultaneously the paper's effectiveness metric. The white-box Table I increases are therefore increases in the exact function being optimized: they are expected by construction whenever the optimizer succeeds, and they cannot independently establish that the colors are semantically implausible. The accompanying conclusion, 'showing that the outputs deviate from content-conditioned color priors,' restates the definition of the optimization target rather than providing external evidence. Because CaCDD is a newly introduced, ground-truth-free metric with no human validation (Sec. VI defers human studies), the headline quantitative claim reduces to the optimized loss. CF increases and black-box cells provide partial

full rationale

The main circularity is structural: the paper optimizes CaCDD and then reports CaCDD increases as evidence of effectiveness. This is not a case of author self-citation or renamed prior results; the self-citation to PAChroma [6] is used mainly as a baseline and optimization-backbone reference, not to establish the central claim. However, the paper's own abstract states that CaCDD is 'used both as the optimization objective of SCNB and as an evaluation metric,' and Eq. (1) confirms the optimization target is CaCDD. The strongest quantitative results (e.g., BigColor CaCDD 1.26→3.05, +142%) are therefore forced in the white-box setting by construction, and the robustness numbers are also CaCDD-based. The paper does include independent signals: CF rises sharply, black-box transfer is reported, and post-processed outputs are measured; these prevent the whole contribution from being definitionally empty. But because CaCDD is the only operational definition of 'content-inconsistent' and is not validated against human judgment or any external plausibility benchmark, the central claim that SCNB produces 'visibly content-inconsistent colors' remains partially circular. Score 6 reflects partial circularity: one or more headline predictions reduce by construction, while independent content still exists.

Axiom & Free-Parameter Ledger

8 free parameters · 5 axioms · 1 invented entities

The ledger's central item is CaCDD itself: the paper's quantitative claims are denominated in a metric that is also the attack objective, and that metric rests on unvalidated assumptions about GMM color priors tracking human perception. The remaining free parameters are mostly standard optimization and prior-construction choices.

free parameters (8)
  • GMM components per semantic label (K) = 3
    Hand-chosen (Section IV-C, App. Table III); controls the granularity of the natural-color density and thus what counts as out-of-distribution.
  • hue weight (lambda_hue) = 1.0
    Hand-chosen balance between OoD chroma distance and hue-direction inconsistency in CaCDD (Eq. 7, App. Table III); directly shapes both attack objective and evaluation.
  • chroma threshold tau for hue weighting (w_p) = not stated
    Down-weights near-grayscale pixels in the hue term (Eq. 5); value not reported, affects metric sensitivity.
  • numerical stability constant epsilon_d = not stated
    Used in Eq. (6) to avoid division by zero in hue direction; hand-chosen.
  • GMM covariance regularization lambda_reg = 1e-4
    App. Table III; stabilizes fits and inflates covariance, shrinking Mahalanobis distances.
  • mask-acceptance thresholds (area_min/area_max/score_min/box_min/text_min/bbox_IoU_min, top-m tags, N_min/N_max) = 0.01/0.95/0.35/0.30/0.30/0.30, 25, 500/2000
    App. Table III; determine which pixels are scored by CaCDD, so they calibrate both the priors and the evaluation.
  • optimization hyperparameters (T, alpha, mu, N, block splits) = T=100, alpha=epsilon/10, mu=1.0, N=20, split=3
    Algorithm 1; standard adversarial-loop settings, not fitted to data.
  • perturbation budget epsilon = 4/255 to 32/255
    Experimentally swept, not fitted; sets the imperceptibility/effectiveness trade-off.
axioms (5)
  • domain assumption Deviations from class-conditional GMM color priors in CIELAB correspond to human-perceived color unnaturalness.
    Section IV-C and Eq. (7); no human study validates the mapping (conclusion defers human studies).
  • domain assumption RAM + Grounded-SAM segmentation of ImageNet, filtered by Table III thresholds, yields reliable semantic regions whose ab-samples represent the label's natural colors.
    App. VII-A; mask errors would bias priors and hence the metric used for both attack and evaluation.
  • domain assumption ImageNet color statistics represent 'natural' color for the deployment targets (manga panels, archival photographs).
    Priors are built and evaluated only on ImageNet (Section V); no domain-shift evaluation.
  • domain assumption A defender can craft against surrogate colorizers whose vulnerabilities transfer to the attacker's unknown model.
    Section III requirement (4); single-source transferability is weak in Table I (+9% to +20% CaCDD on unseen models), so this assumption is only partially met.
  • standard math Momentum iterative adversarial optimization (MI-FGSM) with input transformations finds a useful local maximum of CaCDD.
    Algorithm 1; standard optimization practice adapted from [6], [12].
invented entities (1)
  • CaCDD (Content-aware Color Distributional Distance) independent evidence
    purpose: Ground-truth-free scoring of semantic color plausibility; used simultaneously as the SCNB optimization objective (Eq. 1) and the effectiveness metric (Tables I, II, V).
    Not a physical entity but a new construct. It has limited external anchors: the green/blue apple sanity check (Fig. 4) and weak correlation with CF/PSNR/SSIM (Fig. 12), but no human validation; the paper's headline effectiveness numbers are this metric's own values.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors." pith.science (2026). https://pith.science/paper/FUCEHHAU

@misc{pith2026260717610,
  author       = {Pith},
  title        = {Pith review of: Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FUCEHHAU}},
  note         = {Machine review of arXiv:2607.17610}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Automatic image colorization enables large-scale and low-cost reuse of grayscale media (e.g., manga panels and archival photographs), facilitating unauthorized reuse and redistribution. Once released online, grayscale content can be readily turned into unauthorized colorized derivatives using off-the-shelf models, creating a practical need for proactive, content-side protection at publication time. Building on Uncolorable Examples (UE), which add imperceptible perturbations to released grayscale images to degrade unauthorized colorization, we propose Semantic Color Naturalness Breaker (SCNB) -- a semantic-level UE framework that drives colorization outputs toward content-inconsistent colors while preserving the visual fidelity of the released grayscale media. We further introduce Content-aware Color Distributional Distance (CaCDD), a ground-truth-free, content-aware measure of color plausibility derived from semantic color priors, used both as the optimization objective of SCNB and as an evaluation metric. Experiments on ImageNet show that our method remains effective under small perturbation budgets and common post-processing, supporting practical deployment in real-world content-sharing pipelines.

Figures

Figures reproduced from arXiv: 2607.17610 by Ching-Chun Chang, Futa Waseda, Isao Echizen, Yuki Nii.

Figure 1
Figure 1. Figure 1: SCNB breaks semantic color plausibility. UE generated from PAChroma suppresses chroma magnitude but can leave gray-but-natural outputs, whereas SCNB induces content-inconsistent colors even under restricted settings. (UE) [6] as a content-side defense, and proposed a chroma￾suppression method, PAChroma [6], which aimed to enforce grayscale outputs. However, we identify a fundamental limi￾tation: under real… view at source ↗
Figure 2
Figure 2. Figure 2: Uncolorable Example generated from SCNB inducing implausible color. Each image is shown with its SSIM between the inputs and CaCDD score. • Real-world suitability: Experiments on ImageNet show that SCNB remains effective under small pertur￾bation budgets and common post-processing operations, supporting practical deployment in real-world sharing pipelines. II. RELATED WORK Automatic colorization. Automatic… view at source ↗
Figure 3
Figure 3. Figure 3: SCNB pipeline. SCNB maximizes CaCDD to induce content-inconsistent color via adversarial examples utilized by input transformation and a Laplacian mask. “apple” : CaCDD↓= 3.73 “apple” : CaCDD↓= 1.27 CF↑=89.6, PSNR↑=14.5, SSIM↑=0.69 CF↑=114.7, PSNR↑=12.1, SSIM↑=0.68 Green Apple (natural) Blue Apple (unnatural) Conventional Evaluations Proposed “apple” : CaCDD↓= 1.03 Undetectable Detectable Undetectable Dete… view at source ↗
Figure 4
Figure 4. Figure 4: CaCDD captures content-aware color plausibility. Distinguishing natural from semantically implausible col￾orizations beyond CF/PSNR/SSIM. This motivates SCNB. Rather than minimizing chroma magnitude, SCNB explicitly drives the output color to be￾come inconsistent with content-semantics–conditioned color priors, producing colorizations that are difficult for down￾stream reuse [PITH_FULL_IMAGE:figures/full_… view at source ↗
Figure 6
Figure 6. Figure 6: Region-wise CaCDD visualization. Low CaCDD indicates semantically plausible colors, whereas high CaCDD indicates content-inconsistent colors. where θp is the angle between the pixel color direction and the nearest GMM mean direction, and wp = min(1, ∥zp∥/τ ) down-weights near-grayscale pixels. Let mp = max k zˆ ⊤ p µˆc(p),k, zˆp = zp ∥zp∥ + εd , µˆc(p),k = µc(p),k ∥µc(p),k∥ + εd , (6) and set θp = arccos(c… view at source ↗
Figure 5
Figure 5. Figure 5: Semantic prior construction. Open-vocabulary tags and masks are used to collect ab channels of CIELAB per class and fit class-conditional GMM priors. the nearest GMM mean direction, capturing cases where the chroma magnitude may be moderate but the hue itself is wrong (e.g., reddish vegetation instead of green). Let {πc,k, µc,k, Σc,k} K k=1 be the GMM parameters, εd a small constant for numerical stability… view at source ↗
Figure 7
Figure 7. Figure 7: Effectiveness under small perturbation budgets. As ϵ decreases, SCNB still induces content-inconsistent colors, whereas PAChroma tends to produce desaturated yet semantically plausible outputs. (Best viewed in zoom) grayscale. Robustness is evaluated under JPEG compression (quality 75 and 50) and random resized cropping (RRC), simulating common degradation encountered during online sharing. All experiments… view at source ↗
Figure 9
Figure 9. Figure 9: Improved transferability via ensemble-crafted UE. Rows correspond to surrogate ensembles used for crafting SCNB and columns to attack (evaluation) models. TABLE II: Transferability with ensemble-crafted UE. CaCDD increases on unseen target models under ϵ=32/255 when SCNB is crafted using multiple surrogate colorizers. Source Model Attack model CaCDDunprot CaCDDprot DeOldify + BigColor DeOldify 1.41 2.84 (+… view at source ↗
Figure 10
Figure 10. Figure 10: Illustrative idea of CaCDD components. H(p) evaluates the inconsistency of hue directions, wheras D(p) measures the out-of-distribution distance to the GMM. TABLE IV: Evaluation of colorization models on Ima￾geNet (val50k). FID, PSNR, SSIM evaluates feature/pixel level similarity. CF measures chroma magnitude, where CaCDD demonstates semantic color plausibility. Method GT-required GT-free FID↓ PSNR↑ SSIM↑… view at source ↗
Figure 11
Figure 11. Figure 11: Ablation of CaCDD components. Each component alone can yield plausible-looking colors; using both terms is more consistent at producing content-inconsistent color. (Best viewed in zoom) B. Results Under Smaller Perturbation Table V shows that SCNB remains effective even at small perturbation budgets, consistently increasing CaCDD (i.e., inducing content-inconsistent color) across attack models. For exampl… view at source ↗
Figure 12
Figure 12. Figure 12: CaCDD show weak correlation to conventional metrics. Scatter plots of CaCDD vs. CF, SSIM, and PSNR evaluated with outputs of BigColor, DDColor, and DeOldify. TABLE V: SCNB vs. PAChroma on ImageNet (mean over 80 runs: 40 images × 2 seeds). We report CF and CaCDD on unprotected/protected outputs, and CaCDD after post-processing (JPEG Q=75/50, RRC). SCNB increases CaCDD, while PAChroma reduces CF. Method Att… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

19 extracted references · 5 linked inside Pith

  1. [1]

    Towards vivid and diverse image colorization with generative color prior,

    Yanze Wu, Xintao Wang, Yu Li, Honglun Zhang, Xun Zhao, and Ying Shan, “Towards vivid and diverse image colorization with generative color prior,” 2022

    2022

  2. [2]

    Ddcolor: Towards photo-realistic image coloriza- tion via dual decoders,

    Xiaoyang Kang, Tao Yang, Wenqi Ouyang, Peiran Ren, Lingzhi Li, and Xuansong Xie, “Ddcolor: Towards photo-realistic image coloriza- tion via dual decoders,” 2023, https://arxiv.org/abs/2212.11613

    Pith/arXiv arXiv 2023

  3. [3]

    Palette: Image-to-image diffusion models,

    Chitwan Saharia, William Chan, Huiwen Chang, Chris A. Lee, Jonathan Ho, Tim Salimans, David J. Fleet, and Mohammad Norouzi, “Palette: Image-to-image diffusion models,”arXiv preprint arXiv:2111.05826, 2022

    Pith/arXiv arXiv 2022

  4. [4]

    I will color and repaint manga and comic pages using ai,

    Fiverr, “I will color and repaint manga and comic pages using ai,” https://www.fiverr.com/striderxyz/color-and-r epaint-manga-and-comic-pages-using-ai, Accessed: 2026-01-21

    2026

  5. [5]

    Selling of pirated dvds of classic black-and-white films found guilty,

    Content Overseas Distribution Association (CODA), “Selling of pirated dvds of classic black-and-white films found guilty,”https: //coda-cj.jp/en/news/832/, Jan. 2026, Accessed: 2026-02- 04

    2026

  6. [6]

    Uncolorable examples: Preventing unauthorized ai colorization via perception-aware chroma-restrictive perturbation,

    Yuki Nii, Futa Waseda, Ching-Chun Chang, and Isao Echizen, “Uncolorable examples: Preventing unauthorized ai colorization via perception-aware chroma-restrictive perturbation,”arXiv preprint arXiv:2510.08979, 2025

    arXiv 2025

  7. [7]

    DeOldify: Deep learning for image colorization and restoration,

    Jason Antic, “DeOldify: Deep learning for image colorization and restoration,” 2021, GitHub,https://github.com/jantic/De Oldify

    2021

  8. [8]

    Bigcolor: Colorization using a generative color prior for natural images,

    Geonung Kim, Kyoungkook Kang, Seongtae Kim, Hwayoon Lee, Sehoon Kim, Jonghyun Kim, Seung-Hwan Baek, and Sunghyun Cho, “Bigcolor: Colorization using a generative color prior for natural images,” 2022

    2022

  9. [9]

    Intriguing properties of neural networks,

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Du- mitru Erhan, Ian Goodfellow, and Rob Fergus, “Intriguing properties of neural networks,”arXiv preprint arXiv:1312.6199, 2013

    Pith/arXiv arXiv 2013

  10. [10]

    Ex- plaining and harnessing adversarial examples,

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy, “Ex- plaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

    Pith/arXiv arXiv 2014

  11. [11]

    Towards deep learning models resistant to adversarial attacks,

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, “Towards deep learning models resistant to adversarial attacks,” inInternational Conference on Learning Representations (ICLR), 2018

    2018

  12. [12]

    Structure- preserving transformation for adversarial example generation,

    Chen Shen, Yinpeng Dong, Hang Su, and Jun Zhu, “Structure- preserving transformation for adversarial example generation,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021, pp. 6890–6900

    2021

  13. [13]

    Glaze: Protecting artists from style mimicry by text-to-image models,

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y . Zhao, “Glaze: Protecting artists from style mimicry by text-to-image models,” inUSENIX Security Symposium, 2023

    2023

  14. [14]

    Nightshade: Prompt-specific poisoning attacks on text-to-image generative models,

    Shawn Shan, Wenxin Ding, Josephine Passananti, Stanley Wu, Haitao Zheng, and Ben Y . Zhao, “Nightshade: Prompt-specific poisoning attacks on text-to-image generative models,” inIEEE Symposium on Security and Privacy (SP), 2024

    2024

  15. [15]

    Raising the cost of malicious AI-powered image editing,

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander Madry, “Raising the cost of malicious AI-powered image editing,” inProceedings of the 40th International Conference on Machine Learning, Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, Eds. 2023, vol. 202 ofProceedings of Mach...

    2023

  16. [16]

    Measuring colourfulness in natural images,

    David Hasler and Sabine Suesstrunk, “Measuring colourfulness in natural images,”Proceedings of SPIE - The International Society for Optical Engineering, vol. 5007, pp. 87–95, 06 2003

    2003

  17. [17]

    Recognize anything: A strong image tagging model,

    Youcai Zhang, Xinyu Huang, Jinyu Ma, Zhaoyang Li, Zhaochuan Luo, Yanchun Xie, Yuzhuo Qin, Tong Luo, Yaqian Li, Shilong Liu, Yandong Guo, and Lei Zhang, “Recognize anything: A strong image tagging model,” 2023

    2023

  18. [18]

    Grounded sam: Assembling open-world models for diverse visual tasks,

    Tianhe Ren, Shilong Liu, Ailing Zeng, Jing Lin, Kunchang Li, He Cao, Jiayu Chen, Xinyu Huang, Yukang Chen, Feng Yan, Zhaoyang Zeng, Hao Zhang, Feng Li, Jie Yang, Hongyang Li, Qing Jiang, and Lei Zhang, “Grounded sam: Assembling open-world models for diverse visual tasks,”arXiv preprint arXiv:2401.14159, 2024

    Pith/arXiv arXiv 2024

  19. [19]

    Imagenet: A large-scale hierarchical image database,

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei- Fei, “Imagenet: A large-scale hierarchical image database,” inIEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2009, pp. 248–255. Appendix for ”Semantic Color Naturalness Breaker: Preventing Illegitimate Colorization via Content-Aware Color Priors” Yuki Nii⋆ Futa Waseda⋆ ...

    arXiv 2009

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.