Pith. sign in

REVIEW 4 major objections 5 minor 27 references

DCT-Shield: A Robust Frequency Domain Defense against Malicious Image Editing

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Adding imperceptible noise in the DCT domain blocks AI image editing and survives JPEG compression.

desk verdict DCT-Shield is a genuine step forward for JPEG-robust image immunization, but the main text needs more evidence on cross-model transfer and statistical rigor before the headline claim is fully established. read the letter →

arxiv 2504.17894 v2 pith:YTY5YZ7R submitted 2025-04-24 cs.CV

Aniruddha Bala , Rohit Chowdhury , Rohan Jaiswal , Siddharth Roheda This is my paper · ORCID
classification cs.CV
keywords DCT-Shieldimageimmunizationfrequency-domainadversarialperturbationJPEGrobustnessdiffusionmodeleditingdefenseVAElatentattackimperceptiblenoiseinpainting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that protecting images from malicious diffusion-based editing is more effective when the protective noise is added in the frequency domain rather than in pixel space. Its method, DCT-Shield, perturbs the quantized DCT coefficients of an image inside a JPEG encode-decode loop, optimizing the perturbation so that the immunized image encodes to a near-zero latent in the VAE of a latent diffusion model. The central claim is that this produces immunized images that are visually almost indistinguishable from the originals, that still defeat text-prompt edits, and that keep their protection after JPEG compression that strips away pixel-space attacks. If correct, this would make image immunization practical for real sharing pipelines, where recompression is routine. The evidence is experimental: comparisons against PhotoGuard, MIST, AdvDM, and SDS(-) on InstructPix2Pix and Stable Diffusion Inpainting across multiple datasets and purification techniques.

What carries the argument

The central object is the JPEG pipeline used as a differentiable transform. DCT-Shield JPEG-encodes the input to quantized DCT coefficients, adds the adversarial perturbation $\delta$ to those coefficients, and JPEG-decodes to form the immunized image $x'$; gradients flow through the decode step because the perturbation is added after quantization. The loss is the L2 norm of the VAE latent of $x'$, minimized by PGD, with the bound $\epsilon\ge 1$ guaranteeing at least one quantization-level change so the perturbation survives recompression. Variants restrict the perturbation to the Y (luminance) channel or to a mask over inpainting regions. This machinery carries the argument because it aligns the perturbation with the human visual system's frequency sensitivity and with the exact compression operation used to purify images.

What would settle it

Test DCT-Shield immunized images against an editing model whose VAE encoder is a different checkpoint or architecture (for instance, SDXL or a fine-tuned Stable Diffusion variant). If faithful text-prompt edits still succeed while the latent norm is near zero, the universality claim is refuted; if JPEG recompression at a quality above the immunization setting $Q_{\text{alg}}$ restores editable images, the JPEG-robustness claim is refuted.

Watch

Extended reading notes

Core claim

DCT-Shield's core discovery is that operating in the DCT domain decouples imperceptibility from JPEG robustness: the perturbation is added after quantization, so it is expressed in exactly the units that JPEG recompression preserves. The optimization objective is $L(\delta)=\|E(x')\|_2$, where $E$ is the VAE encoder and $x'$ is the image reconstructed from perturbed quantized coefficients, minimized by projected gradient descent with the perturbation bound $\epsilon\ge 1$. The paper reports that this encoder-only objective breaks edits on InstructPix2Pix and Stable Diffusion Inpainting, yields better perceptual fidelity than pixel-space baselines on LPIPS, FID, VIFp, SSIM, and human evaluation, and retains protection under JPEG compression at qualities 65-95%, crop-and-resize, and AdvClean purification.

Load-bearing premise

The claim depends on the assumption that pushing the VAE latent of the immunized image to near-zero norm is sufficient to defeat any prompt-conditioned edit by any downstream editing model, even though the paper gives no mechanism for why a collapsed latent makes edits fail.

Editorial extensions

If this is right

  • Users can tune $Q_{\text{alg}}$ and $\epsilon$ to choose how much JPEG purification the protection survives, at the cost of more visible noise.
  • Because only a VAE encoder is needed in the optimization loop, immunization is computationally cheaper and independent of the U-Net architecture of the target editor.
  • The parameter count drops from $O(3HW)$ for pixel-space perturbations to $O(3HW/2)$ for the base variant and $O(HW)$ for the Y-channel variant.
  • The method protects against inpainting as well as prompt-based editing, using a mask-based variant that concentrates noise on editable regions.
  • Immunized images remain storable in any format; the JPEG pipeline is only part of the optimization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next test is whether the latent-norm objective can be replaced by a target-latent or distribution-matching term; a fixed nonzero target might transfer better to editors with different VAEs.
  • The same DCT-domain strategy suggests an extension to video by perturbing the DCT coefficients of I-frames in standard video codecs, immunizing frames without per-frame pixel noise.
  • The observable prediction that protection holds for JPEG qualities above $Q_{\text{alg}}$ could be validated directly against real social-media recompression pipelines, which is where the robustness claim would matter in practice.
  • The paper leaves open whether the near-zero latent is necessary or merely sufficient; ablating with random small-norm latents would clarify the mechanism behind failed edits.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes DCT-Shield, an image immunization method that adds adversarial perturbations to quantized DCT coefficients inside a differentiable JPEG encode/decode loop. The perturbation is optimized by projected gradient descent to minimize the L2 norm of the VAE latent of the immunized image, with optional masks for inpainting and a Y-channel variant for high JPEG compression. The authors claim that DCT-Shield introduces fewer visual artifacts than pixel-space defenses while maintaining comparable edit protection and robustness to purification, and they report experiments against AdvDM, MIST, PhotoGuard, SDS(-), and DiffusionGuard on 150 OmniEdit samples and 56 inpainting samples, using perceptual metrics and human evaluation.

Significance. If the claims hold, frequency-domain immunization is a practically important alternative to pixel-space defenses, because it couples imperceptibility with JPEG robustness by construction. The paper is not circular: Eq. (8)'s objective is a generic latent-fooling loss, not a fit to the evaluation metrics, and the metrics used for evaluation are external to the training objective. The main strengths are the clear problem formulation, the qualitative demonstrations, and the breadth of purification tests. The central claims, however, rest on comparisons that are not yet commensurate and on generalization evidence that is mostly deferred to the supplementary, so the significance is real but currently under-supported.

major comments (4)
  1. [§6.1, Table 1] The central 'fewer visual artifacts' claim is not supported by a commensurate comparison: baselines are restricted to an L∞ budget of 16/255, while DCT-Shield is unconstrained in pixel space and its actual pixel-space perturbation norm is never reported. Perceptual metrics such as LPIPS and FID are correlated with but not identical to a perturbation budget, and Fig. 5 compares DCT-domain ε values with pixel-domain budgets on the same axes. Please report mean/max L∞ and L2 pixel norms for all methods and include a matched-budget experiment.
  2. [§4.1, §4.2, §5.3] The threat model states that the defender has no knowledge of the editor's U-Net, yet the optimization objective L(δ)=∥E(x′)∥2 (Eq. 8) depends on a specific VAE, and only InstructPix2Pix and SD-Inpainting are evaluated in the main text. No mechanism or derivation is provided for why a near-zero latent blocks arbitrary prompts and editors, and cross-model transferability is deferred to supplementary §D.5. Add main-text evaluation with a different VAE or an inversion-based editor, or explicitly narrow the threat model.
  3. [§5.1, Tables 1-2] The evaluation sets are small (150 and 56 samples) and no error bars, confidence intervals, or significance tests are reported. Several headline differences are small—for example, edit-protection LPIPS is 0.684 for DCT-Shield versus 0.681 for SDS(-) in Table 1. Without variance estimates, the claims of 'outperforms' and 'similar levels of edit protection' are not statistically grounded. Report per-sample distributions and paired tests.
  4. [§4.2, Eq. (9)] The perturbation δ is real-valued but is added to integer quantized coefficients α, so as written JPEG_D(α+δ) is not a standard JPEG decode and the gradient path explicitly bypasses quantization. The statement that ε≥1 guarantees 'at least one quantization level change' is only true after rounding/re-quantization, which is absent from the optimization. Specify the rounding operation in Eq. (9) and test whether real-valued optimized perturbations survive an actual JPEG re-encode step.
minor comments (5)
  1. [§3.3, Eq. (6)] The scaling factor fs is introduced but never defined in terms of Qalg; please define it or reference the standard JPEG formula.
  2. [§4.2] In the line '∥δ∥inf≤ϵ', the norm symbol should be ∥δ∥∞≤ϵ.
  3. [§4.2] The text 'aligns with findings from Liu et al. [24]' appears to refer to Diff-Protect [12], not Xue et al. [24]; please correct the citation.
  4. [Table 2] The inpainting human-evaluation scores are reported without sample sizes or inter-rater agreement; please provide these details.
  5. [§5.1, Tables 1-2] It is unclear how FID is computed for a single image or a small set; please specify the reference and generated distributions used for each FID entry.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: DCT-Shield's protection is evaluated with external metrics and a generic latent-fooling objective; no fitted parameter is renamed as a prediction.

full rationale

The paper's core objective (Eq. 8) minimizes ||E(x')||2 on the VAE latent of the JPEG-decompressed immunized image. This is an untargeted adversarial objective whose inputs (image x, VAE E, quality Qalg, bound epsilon) do not include the benchmark quantities used to measure success (LPIPS, FID, SSIM, PSNR, VIFp, human evaluation). No equation in the manuscript reduces edit-protection performance to a fitted parameter, and the JPEG robustness property follows from the explicit design choice of optimizing in the quantized DCT domain rather than from a circular equation. The citation to Diff-Protect (Xue et al.) for VAE vulnerability is external to the present authors and is used only as supporting motivation, with the paper's own empirical comparison confirming the choice. Cross-model generalization is admittedly limited in the main text and deferred to supplementary section D.5, which is a completeness limitation, not circularity. The central claim is thus independently testable against external benchmarks.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or model entities. Its central claim relies on hand-set optimization parameters (epsilon, Qalg, step size, iterations) and on empirical assumptions about VAE vulnerability (borrowed from prior work) and metric validity. The loss is a generic untargeted latent-fooling objective, not fitted to the evaluation benchmark.

free parameters (5)
  • epsilon (perturbation bound on quantized DCT coefficients) = 1
    Chosen by hand; the paper states ϵ≥1 is required to induce at least one quantization level change. Default for all channels.
  • Qalg (JPEG quality used during optimization) = 0.95 (base), 0.9 (inpainting), 0.85 (Y-channel JPEG robustness)
    Tuning parameter that trades off robustness range versus imperceptibility; different values used across experiments.
  • PGD step size gamma = 0.1
    Standard optimization hyperparameter, set without sensitivity analysis.
  • Number of PGD iterations = 1000
    Default setting; no convergence analysis or runtime budget reported.
  • Loss function L(delta)=||E(x')||_2 = N/A
    Selected empirically after comparisons; the paper notes norm minimization works best, without a proof of optimality.
assumptions (4)
  • domain assumption The VAE encoder of a latent diffusion model is more vulnerable to adversarial perturbation than the U-Net (based on Liu et al. [24]).
    The paper relies on this to justify using only the VAE in the optimization loop and to explain why the norm-minimization loss works; this is carried into the method design.
  • standard math The JPEG encode-decode pipeline is differentiable with respect to post-quantization DCT coefficients, allowing gradient backpropagation through JPEG_D.
    The paper adds perturbations after quantization and relies on the linearity of dequantization, IDCT, and color conversion to compute gradients; this is an implementation-level mathematical assumption.
  • domain assumption Perceptual metrics (FID, LPIPS, PSNR, SSIM, VIFp) adequately reflect human perception of added noise in place of a pixel-norm budget.
    The paper argues that RGB norms do not reliably reflect perception (citing [19, 26]) and uses these metrics to compare imperceptibility across methods with different perturbation parameterizations.
  • domain assumption Results on InstructPix2Pix and Stable Diffusion Inpainting generalize to other editing models and prompts.
    The main text evaluates only these two models; cross-model transferability is claimed in the supplementary, which is not available in the main text review.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DCT-Shield: A Robust Frequency Domain Defense against Malicious Image Editing." pith.science (2026). https://pith.science/paper/YTY5YZ7R

@misc{pith2026250417894,
  author       = {Pith},
  title        = {Pith review of: DCT-Shield: A Robust Frequency Domain Defense against Malicious Image Editing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YTY5YZ7R}},
  note         = {Machine review of arXiv:2504.17894}
}
read the original abstract

Advancements in diffusion models have enabled effortless image editing via text prompts, raising concerns about image security. Attackers with access to user images can exploit these tools for malicious edits. Recent defenses attempt to protect images by adding a limited noise in the pixel space to disrupt the functioning of diffusion-based editing models. However, the adversarial noise added by previous methods is easily noticeable to the human eye. Moreover, most of these methods are not robust to purification techniques like JPEG compression under a feasible pixel budget. We propose a novel optimization approach that introduces adversarial perturbations directly in the frequency domain by modifying the Discrete Cosine Transform (DCT) coefficients of the input image. By leveraging the JPEG pipeline, our method generates adversarial images that effectively prevent malicious image editing. Extensive experiments across a variety of tasks and datasets demonstrate that our approach introduces fewer visual artifacts while maintaining similar levels of edit protection and robustness to noise purification techniques.

Figures

Figures reproduced from arXiv: 2504.17894 by the authors.

Figure 1
Figure 1. A comparison of our proposed method, DCT-Shield’s, [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of DCT-Shield. The algorithm takes in an input image x, algorithm quality setting Qalg and perturbation bound ϵ. For inpainting tasks, it also uses an additional mask as input. The adversarial perturbation δ is added to the input image’s DCT coefficients. The adversarial (or immunized) image x ′ is passed through a VAE to obtain a corresponding latent z, which in turn is used to define a loss function. The … view at source ↗
Figure 3
Figure 3. Qualitative analysis comparing DCT-Shield with baseline methods. For each example, the first row presents the original input (source) image alongside the corresponding immunized images. The second row illustrates the edited version of the original image, followed by the edited immunized images across different baselines. DCT-Shield exhibits comparable or superior resistance to edits while maintaining significantly l… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Qualitative results for inpainting tasks. The first row presents the input (source) image alongside immunized images generated by different methods. The second row displays the inpainting edit of the input image, followed by the corresponding edits of the immunized ima…
Figure 6
Figure 6. Figure 6: Qualitative results on JPEG robustness. The first two rows show the original and immunized images with their corre￾sponding edits. Subsequent rows show edits on purified images, with each row corresponding to a given JPEG quality. The edit prompt is "Make the Bengal ca…
Figure 7
Figure 7. Figure 7: Comparison of robustness against JPEG￾purification. LPIPS(↑) score is computed between edits of origi￾nal and purified images. DCT-Shield maintains higher score across varying levels of JPEG purification, indicating stronger robust￾ness. only encoder-based optimization…
Figure 8
Figure 8. Figure 8: Robustness against AdvClean and crop-and-resize. Comparison of DCT-Shield with baseline methods in terms of LPIPS(↑) , FID(↑) and SSIM(↓) between edits of original and pu￾rified images. DCT-Shield demonstrates overall better robustness against both purification methods…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 14 canonical work pages

  1. [12]

    Diff- protect: Generate adversarial examples with diffusion models for facial privacy protection

    Jiang Liu, Chun Pong Lau, and Rama Chellappa. Diff- protect: Generate adversarial examples with diffusion models for facial privacy protection. arXiv preprint arXiv:2305.13625, 2023

    arXiv 2023

  2. [1]

    Blended diffusion for text-driven editing of natural images

    Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), page 18187–18197. IEEE, 2022. 2

    work page 2022

  3. [2]

    In- structpix2pix: Learning to follow image editing instructions

    Tim Brooks, Aleksander Holynski, and Alexei A Efros. In- structpix2pix: Learning to follow image editing instructions. arXiv preprint arXiv:2211.09800, 2022. 2, 5

    arXiv 2022

  4. [3]

    IMPRESS: Evaluat- ing the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Genera- tive AI

    Bochuan Cao, Changjiang Li, Ting Wang, Jinyuan Jia, Bo Li, and Jinghui Chen. IMPRESS: Evaluat- ing the Resilience of Imperceptible Perturbations Against Unauthorized Data Usage in Diffusion-Based Genera- tive AI . In Advances in Neural Information Pro- cessing Systems , pages 10657–10677. Curran Asso- ciates, Inc., 2023. URL: https : / / proceedings . neu...

    work page 2023

  5. [4]

    Editshield: Protecting unautho- rized image editing by instruction-guided diffusion models

    Ruoxi Chen, Haibo Jin, Yixin Liu, Jinyin Chen, Haohan Wang, and Lichao Sun. Editshield: Protecting unautho- rized image editing by instruction-guided diffusion models. In Computer Vision – ECCV 2024 , pages 126–142, Cham,

    work page 2024

  6. [5]

    Diffusionguard: A robust defense against malicious diffusion-based image editing

    June Suk Choi, Kyungmin Lee, Jongheon Jeong, Saining Xie, Jinwoo Shin, and Kimin Lee. Diffusionguard: A robust defense against malicious diffusion-based image editing. In The Thirteenth International Conference on Learning Rep- resentations, 2025. 2, 5, 7, 8

    work page 2025

  7. [6]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples, 2015. 2

    2015

  8. [7]

    Clipscore: A reference-free evaluation met- ric for image captioning, 2022

    Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. Clipscore: A reference-free evaluation met- ric for image captioning, 2022. 5

    2022

Show all 27 references
  1. [8]

    Gans trained by a two time-scale update rule converge to a local nash equilib- rium, 2018

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilib- rium, 2018. 5

    2018

  2. [9]

    Mist: Towards improved adversarial examples for diffusion models

    Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv:2305.12683, 2023. 2, 5, 6, 7

    2023 arXiv

  3. [10]

    Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yim- ing Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial exam- ples. In Proceedings of the 40th International Conferenc...

    2023

  4. [11]

    Ppr10k: A large-scale portrait photo retouch- ing dataset with human-region mask and group-level consis- tency

    Jie Liang, Hui Zeng, Miaomiao Cui, Xuansong Xie, and Lei Zhang. Ppr10k: A large-scale portrait photo retouch- ing dataset with human-region mask and group-level consis- tency. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2021. 5

    2021

  5. [13]

    Distraction is all you need: Memory-efficient im- age immunization against diffusion-based image editing

    Ling Lo, Cheng Yu Yeo, Hong-Han Shuai, and Wen-Huang Cheng. Distraction is all you need: Memory-efficient im- age immunization against diffusion-based image editing. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 24462–24471,

  6. [14]

    Towards deep learning models resistant to adversarial attacks, 2019

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. 2

    2019

  7. [15]

    Sdedit: Guided image synthesis and editing with stochastic differential equa- tions, 2022

    Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jia- jun Wu, Jun-Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equa- tions, 2022. 2

    2022

  8. [16]

    High-resolution image syn- thesis with latent diffusion models, 2021

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image syn- thesis with latent diffusion models, 2021. 1, 5

    2021

  9. [17]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2

    2022

  10. [18]

    Raising the cost of malicious ai-powered image editing

    Hadi Salman, Alaa Khaddaj, Guillaume Leclerc, Andrew Ilyas, and Aleksander M ˛ adry. Raising the cost of malicious ai-powered image editing. In Proceedings of the 40th Inter- national Conference on Machine Learning. JMLR.org, 2023. 2, 5, 6, 7

    2023

  11. [19]

    On the suitability of lp-norms for creating and preventing adver- sarial examples

    Mahmood Sharif, Lujo Bauer, and Michael K Reiter. On the suitability of lp-norms for creating and preventing adver- sarial examples. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops , pages 1605–1613, 2018. 5

    2018

  12. [20]

    Sheikh and Alan C

    Hamad R. Sheikh and Alan C. Bovik. Image information and visual quality. IEEE Transactions on Image Processing, 15 (2):430–444, 2006. 5

    2006

  13. [21]

    G.K. Wallace. The jpeg still picture compression standard. IEEE Transactions on Consumer Electronics , 38(1):xviii– xxxiv, 1992. 3

    1992

  14. [22]

    Bovik, H.R

    Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing , 13(4): 600–612, 2004. 5

    2004

  15. [23]

    Omniedit: Building image edit- ing generalist models through specialist supervision

    Cong Wei, Zheyang Xiong, Weiming Ren, Xinrun Du, Ge Zhang, and Wenhu Chen. Omniedit: Building image edit- ing generalist models through specialist supervision. arXiv preprint arXiv:2411.07199, 2024. 5

    2024 arXiv

  16. [24]

    Toward effective protection against diffusion-based mimicry through score distillation

    Haotian Xue, Chumeng Liang, Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffusion-based mimicry through score distillation. In The Twelfth Interna- tional Conference on Learning Representations, 2024. 1, 2, 4, 5, 6, 7

    2024

  17. [25]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018. 5

    2018

  18. [26]

    Towards large yet imperceptible adversarial image perturbations with perceptual color distance

    Zhengyu Zhao, Zhuoran Liu, and Martha Larson. Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 1036–1045, 2020. 5

    2020

  19. [2025]

    Springer Nature Switzerland. 2

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.