Preventing Latent Diffusion Model-Based Image Mimicry via Angle Shifting and Ensemble Learning

1 Introduction

Latent Diffusion Models (LDMs) exhibit exceptional capabilities [Song et al., 2021; Ho et al., 2020; Sohl-Dickstein et al., 2015; Rombach et al., 2022a], achieving state-of-the-art performance in various image synthesis tasks [Meng et al., 2022; Saharia et al., 2023]. The remarkable progress of LDMs opens up new possibilities in content creation and art design. However, alongside these groundbreaking achievements, the power of LDMs also presents significant ethical and security challenges. Their capabilities can be maliciously exploited to effective vector generate forged human faces or fake artworks. These concerns highlight the urgent need for safeguards to prevent the potential misuse of LDMs.

∗Corresponding author.

Figure 1: The visualization of cancellation effect. The cancellation vector represents the projection of the estimated noise in the direction of the adversarial perturbation.

Currently, protections against unauthorized image mimicry are primarily based on adversarial attack methods. Most existing methods [Liang et al., 2023; Xue et al., 2023; Liang and Wu, 2023] add imperceptible perturbations to input images by maximizing ℓ2 losses (e.g. the original training loss), thus introducing errors into the denoising module of LDMs. The perturbations cause LDMs to predict the ground-truth noise with bias, thereby preventing the generation of high-quality images. However, several issues remain unresolved. Firstly, although the adversarial robustness inherent in the denoising module is pointed out [Xue et al., 2023], the underlying reasons for this robustness remain insufficiently explored, leading to the absence of more effective attacks on the denoising module. Secondly, to protect high-resolution images on devices with limited video memory resources, current approaches [Xue et al., 2023; Liang and Wu, 2023] sacrifice protection performance more or less by altering the adversarial loss or the protected image.

To address these gaps, we investigate the factors contributing to the robustness of the denoising module and identify two key reasons. Firstly, the cancellation effect between adversarial perturbations and estimated noise diminishes the magnitude of perturbations. We refer to the projection of the estimated noise onto the adversarial perturbations as the cancellation vector, and the remaining part of the adversarial perturbations as the effective vector. The adversarial perturbations are severely disrupted by the denoising module during the reverse process as shown in Figure 1. Secondly, multiple attack objectives at multi-step Markov chains and oscillating gradient directions under random Gaussian noises undermine

-

=

the stability of optimization in latent space. We discover that the gradients under different timesteps are complementary as shown in Figure 2, and the gradients under randomly sampled noise are irregular as shown in Figure 3.

Based on these discoveries, we demonstrate that the amplified cancellation effect results frommaximizing the scalesensitive ℓ2 loss, which increases the magnitude of estimated noise when optimizing adversarial perturbations. We conduct an angle-shifting attack by maximizing cosine similarity loss, which introduces bias to the noise estimator without increasing its magnitude. Furthermore, we propose a stable optimization strategy to attack the multi-step Markov chains effectively. Regarding adversarial attacks at different timesteps as a special ensemble attack [Liu et al., 2017], we develop a grouped gradient ensemble strategy to efficiently leverage the complementary gradients at different timesteps. To eliminate the disruption to gradient stability caused by randomly sampled Gaussian noise, we fix the noise in latent space for a certain input image. In addition, we propose an alternating iterative framework. By mathematically decomposing the gradient computations into two steps, we load only the gradients of either the denoising module or the encoder at a time to reduce the VRAM usage. This framework is applicable to other adversarial attacks without compromising their effectiveness.

In summary, our contributions can be divided into the following points.

• Revisiting existing adversarial attacks on LDMs, we propose a plug-and-play alternating iterative framework to decrease VRAM demands without sacrificing attack effectiveness.
• We reveal the cancellation effect between the adversarial perturbations and the estimated noise. To avoid the side effect which is caused by the scale sensitivity of ℓ2 loss, we conduct an angle-shifting attack by maximizing the cosine loss.
• Regarding attacks against the denoising module at different timesteps as an ensemble attack, we propose a gradient ensemble strategy and fix the noise to stabilize the adversarial optimization process.
• Extensive experiments conducted on the facial dataset CelebA-HQ and the artworks dataset WikiArt demon-

strate that our approach outperforms existing protection methods across various scenarios.

2 RelatedWork

PhotoGuard [Salman et al., 2023] proposes attacking the encoder or denoising process of LDMs to raise the cost of malicious AI-Powered image editing. However, attacking the denoising process is impractical due to its significant VRAM requirements. AdvDM [Liang et al., 2023] successfully attacks the denoising module by employing Monte Carlo sampling across timesteps and maximizing the ℓ2 training loss, marking the first effective adversarial attack against the denoising module of LDMs. Mist [Liang and Wu, 2023] builds upon PhotoGuard and AdvDM to implement a hybrid targeted attack. To further minimize video memory usage while protecting high-resolution images, Mist generates low-resolution adversarial patches, which are then assembled into a full image. SDS [Xue et al., 2023] reduces computational complexity and VRAM requirements by discarding the Jacobian term in the loss function. Additionally, SDS demonstrates that minimizing the adversarial loss yields more natural image protection. Most existing methods rely on ℓ2-norm loss and direct PGD optimization in pixel space. MFA [Yu et al., 2024] proposes attacking the denoising module by mean fluctuation under a certain timestep, but calculating the vulnerability of timesteps relies on specific adversarial loss and numerous experiments. In this paper, we introduce an alternating iterative framework that significantly reduces video memory requirements without compromising attack performance, thereby enhancing the practicality of these methods. By revisiting the objective function and optimization strategies of current approaches, we propose an angle-shifting attack alongside a more stable optimization strategy.

3 Preliminary

One of the reasons why LDMs can achieve great success in image generation is that they combine Variational Auto Encoder (VAE) [Kingma and Welling, 2014] and diffusion models [Ho et al., 2020] to improve the efficiency of generation. Firstly, images sampled from the real distribution are compressed through the VAE E(·) encoder as:

Then, the forward process and the reverse process (i.e. denoising process) are carried out on the latent space Z. The forward diffusion process of LDMs is designed to progressively introduce noise into the latent representation z0. The process unfolds over a fixed number of timesteps T . At each timestep t (1 ≤ t ≤ T), the latent variable zt is computed by adding Gaussian noise to the previous latent variable zt-1. Mathematically, the forward process is formulated as:

where ϵt ∼ N(0, I) is a standard Gaussian noise sampled independently at each timestep t. Continuously expand zt-1 in Eq.(2) until reaching z0, and sum up the remaining ϵt. This way, a faster forward sampling Eq.(3) can be obtained.

where ¯αt = ∏ts=1 αs. When t → T ,¯αt → 0,zT almost becomes Gaussian noise.

The reverse process is tasked with recovering the original latent representation z0 from the noisy latent variable zT . The transition probability is defined as pθ(zt-1|zt), which is parameterized by a neural network θ. The network is designed to predict the mean µθ(zt, t) and variance Σθ(zt, t) of the distribution from which zt-1 should be sampled given zt. The predicted mean µθ(zt, t) is computed as

where ϵθ(zt, t) estimates the noise that is added at step t during the forward process. The neural network is trained to minimize the error in this noise estimation. This is accomplished by optimizing the following ℓ2 loss function finally:

4 Methods

To reduce VRAM consumption without sacrificing attack effectiveness, we propose an alternating iterative framework in Sec. 4.1. Building on this framework, we further explore more effective adversarial loss functions in Sec. 4.2 and propose stable optimization strategies in Sec. 4.3. The pipeline of our methods is illustrated in Figure 4.

4.1 Alternating Iterative Framework

In general, existing adversarial attacks on the denoising module consume substantial VRAM, severely limiting their deployment on devices with constrained resources. The existing strategies sacrifice attack performance to overcome this challenge. In this section, we propose an alternating iterative framework that not only enables execution on resourcelimited devices without sacrificing attack effectiveness but also provides deeper insights into the mechanics of current methods.

Let Ladv denote the adversarial loss against the denoising module. The optimization process of previous approaches can be formulated as:

where Π∞ represents the projection operator and xi represents the adversarial example at the i-th iteration. By calculating the gradient of Ladv with respect to the adversarial image x′ , a PGD-based optimization step is performed in the pixel space X to complete one step optimization.

The reason why previous methods consume more VRAM is that they simultaneously load the gradients of both the encoder and the denoiser. Inspired by SDS [Xue et al., 2023], we view the adversarial loss Ladv on the denoising process as a function of the image x in pixel space and the variable z in latent space, where z is derived from x through the VAE encoder E as shown in Eq.(1). According to the chain rule, we can expand Ladv, as:

Note that Eq.(7) is a Vector Jacobian Product (VJP). The first term ∂Ladv ∂zi signifies the gradients in latent space. The second term is the Jacobian matrix that maps the latent gradients to pixel space.

To reduce VRAM demands without altering input images or adversarial loss, we divided the optimization process into two alternating iterative steps as Eq.(8)-(9). Initially, we endeavored to determine an optimal value for zi by solving Eq.(8). Subsequently, this optimal zi∗ serves as guidance for the computation of the VJP as described in Eq.(9).

When computing Eq. (8) or Eq. (9) respectively, only the parameters of the denoiser or encoder are loaded into VRAM, while direct computation of Eq. (6) requires loading both the denoiser and encoder parameters simultaneously. Furthermore, performing one round of computation for Eq.(8) and (9) yields identical results to Eq.(6). Consequently, adversarial attacks based on Eq.(6) can be executed on devices with lower VRAM without sacrificing effectiveness by decomposing the adversarial attack into two alternating iterative steps.

4.2 Angle-Shifting Attack

Most current methods build upon maximizing the ℓ2 loss such as training loss as Eq.(10) to disrupt the denoising process of LDMs to protect the images.

However, these methods overlook the fact that adversarial perturbations δ can be disrupted by the denoiser ϵθ. Based on the framework proposed by Sec. 4.1, we consider perturbations directly on the latent variable z. We revisit the reverse process on adversarial examples by perturbing the Eq.(4) as Eq.(11).

where z′t = √ ¯αt(z0+δ)+√1 - ¯αtϵt represents the adversarial latent variable z0 +δ at timestep t. We find that the adversarial perturbation δ in Eq. (11) is weakened by the denoiser ϵθ(z′t , t). To explore the relationship between δ and ϵθ(z′t , t) simply, we ignore the time-dependent hyper-parameter coefficients √ ¯αt and 1-αt √1-¯αt and decompose ϵθ(z′t , t) orthogonally into two parts: ϵpθ parallel to δ and ϵoθ orthogonal to δ as shown in Figure 5. We find that the directions of -ϵpθ and δ are opposite, and -ϵpθ significantly undermines the effect of the adversarial perturbation by weakening its magnitude. We quantify the cancellation effect between the adversarial perturbations and estimated noise via the magnitude of cancellation vector ϵpθ . As shown in Figure 7, when optimizing the adversarial perturbations, the magnitude of cancellation vector ϵpθ increases simultaneously.

The reason lies in the scale sensitivity of the ℓ2 adversarial loss, which means it is highly sensitive to the magnitude of the vectors. When optimizing ℓ2 losses such as Eq.(10, the magnitude of ϵθ is inevitably increased, which further amplifies the norm of the cancellation vector via projection. Based on the analysis above, we conduct an angle-shifting attack by maximizing the cosine similarity loss to disregard the impact of -ϵpθ as:

4.3 Stable Optimization Strategy

Previous works usually execute attacks by sampling a single timestep t from a uniform distribution at each optimization step. The shortcoming of this approach lies in the fact that one-step optimization in the pixel space X can only concentrate on the adversarial loss corresponding to a particular sampled t. We revisit adversarial optimization under different timesteps from the ensemble attack perspective and design a more efficient grouped gradient ensemble optimization strategy. Moreover, we observe that the random noise can lead to irregular oscillations in the gradient direction. We propose that applying a fixed Gaussian noise is conducive to the stable optimization of adversarial perturbations.

Gradient Ensemble in Latent Space

We perform attacks on the same image at different timesteps and visualize the gradients in Figure 2. It can be observed that the gradients at lower timesteps tend to disturb the noise ϵt while the gradients at higher timesteps tend to disturb z0. To make a better use of the complementary information under different timesteps, we regard adversarial attacks against different timesteps t as those against different models and expect that optimization in the pixel domain X at each step can leverage the latent gradients under different t simultaneously and effectively.

Based on the alternating iterative framework, we propose a grouped gradient ensemble strategy in latent space. As illustrated in Eq.(13)-(14), the gradients under M timesteps ti are computed for current z. Variance normalization is employed as Eq.(13) to eliminate the dimensional differences of the gradients when t varies. Subsequently, the average of these gradients is calculated to obtain an ensemble gradient in the latent space Z. This ensemble gradient is then utilized to guide the optimization in X. Thus, the adversarial perturbations in X at each optimization step can be regarded as an ensemble attack on the denoising estimators under M timesteps.

This process is iterated for N iterations. We name this optimization strategy as the N ×M grouped optimization approach. Specially, the previous optimization methods can be seen as K × 1 strategies. To ensure an equitable comparison, we set N ×M = K. Moreover, since M is considerably smaller than T , the sampling of M timesteps will introduce substantial randomness. To relieve the randomness, we initially sample and sort K timesteps, and then reshape them into an M ×N matrix, which is then transposed to acquire the N ×M timestep grouping as shown in Figure 6. Finally, the ensemble attack effectively leverages complementary information across M timesteps in latent space Z through onestep optimization in the pixel space X, resulting in enhanced overall performance. It can be observed from the ablation experiment in Sec. 5.3 that the proposed optimization strategy effectively enhances the attack performance.

Fixing the Gaussian Noise

When training LDMs, distinct Gaussian noises ϵt are sampled at each t. This noise sampling strategy is widely adopted by previous adversarial attacks to perform the forward sampling of xt as Eq.(2). However, we identify that this approach can induce gradient oscillations, further resulting in unstable optimization directions.

The practice of sampling diverse Gaussian noise during training LDMs is essential for augmenting the diversity of generated images. But in the context of adversarial example generation, the inherent randomness of Gaussian noise sampling introduces substantial instability into the optimization of adversarial perturbations. As illustrated in Figure 3, the gradient exhibits significant fluctuations under different Gaussian noise samples, even when the timestep remains constant. These irregular gradients counteract each other, resulting in unstable optimization directions.

5 Experiments

5.1 Setup

Datasets

We evaluate our methods on two datasets. Considering that infringement issues mainly occur on human faces and artworks, we use a subset of the CelebA-HQ [Karras et al., 2018] and a subset of WikiArt [Nichol, 2016] respectively. We randomly select 500 face images from CelebA-HQ. The WikiArt dataset contains artworks from 27 different styles. We randomly selected 20 images from each style of artworks.

Baseline and Metrics

We compare our methods with four protection methods: AdvDM [Liang et al., 2023], PhotoGuard [Salman et al., 2023], Mist [Liang and Wu, 2023] and SDS [Xue et al., 2023]. To assess the quality of the reconstructed images, we utilize PSNR, SSIM [Wang et al., 2004], LPIPS [Zhang et al., 2018] and FID [Heusel et al., 2017] to evaluate the quality of the reconstructed images. Lower quality of the reconstructed images indicates better protection performance.

Experimental Settings

Following the existing research, we use the ℓ∞-norm to constrain the generated adversarial examples, with the constraint range as 8/255 and the step size α = 1/255. To facilitate the exploration of the impact of the grouping strategy, we set the number of iterations K = 100 for all the methods. For grouping strategy, we set N × M = 20 × 5.

5.2 Protection Performance

We evaluate the performance of our methods on the SDEdit [Meng et al., 2022] task. The input images are resized to 512 × 512. SDEdit conducted image reconstruction based on the backbone of SD-v1-4 [CompVis et al., 2022] and DDIM100 [Song et al., 2021] sampling. The edit strength of forward sampling is set to 0.1, 0.2, and 0.3 respectively.

Table 1 and Table 2 respectively display the quantitative results of our methods on CelebA-HQ and WikiArt. The best results are marked in bold, and the second-best results are underlined. It can be observed that when protecting highresolution images, the protection performance of untargeted attacks (AdvDM,Ours) is superior to that of targeted attacks using textual loss (Mist, PhotoGuard, SDS). Our methods demonstrate SOTA protection performance under different edit strengths. Figure 8 shows the qualitative results of various protection methods when the edit strength is 0.5. The attack methods using texture loss against the encoder reconstruct clear and smooth images with disrupted textures, whereas untargeted attacks cause the reconstructed images to contain a significant amount of high-frequency noise, as these attacks are designed to interfere with the denoising module. Compared with AdvDM which maximizes the ℓ2-norm training loss to optimize adversarial perturbations, the adversarial perturbations generated by our methods lead to a more solid detrimental effect on the denoiser ϵθ. See more experimental results on other tasks in the supplementary materials.

5.3 Ablation Study

Ablation Study on Different Modules

To verify the effectiveness of each module, we conduct ablation experiments on the SDEdit task and the CelebA-HQ dataset. Specifically, we examined the impact of the cosine similarity loss (cos) introduced in Sec. 4.2, the fixed noise (FN) and the Gradient Ensemble (GE) proposed in Sec. 4.3 on the attack performance. We chose AdvDM with ℓ2 training loss as the baseline, which is also the second-best method under this experimental setup. Table. 3 presents the results of the ablation experiments. The results indicate that each of the modules we proposed significantly improves the attack performance. To evaluate the effect of the alternating iterative framework on the attack performance, we designed additional ablation experiments. In addition, we make a further exploration and analysis on the impact of different grouping strategies on the attack effectiveness. The experimental results in the supplementary materials further validate the improvement of protection performance by GE.

Ablation Study on Alternating Iterative Framework

To verify the improvement in VRAM resource usage efficiency and the impact on attack performance of the alternating iterative framework proposed in Sec. 4.1, we conduct experiments on NVIDIA GeForce GTX 1080Ti with 12G VRAM. In this scenario, AdvDM is unable to perform adversarial attacks on 512×512 images. We use three different methods to address this issue:

Figure 9: Figure (a) illustrates the trajectory of ϵ during the optimization of different losses. Compared to the ℓ2 loss, optimizing cosine loss does not increase the norm of ϵ. Figure (b) shows the curve of effective vector norms during optimization, where the cosine loss demonstrates a more effective increase in the norm of the effective vector. Figure (c) depicts the norms of various vectors. The cosine loss achieves the growth of the effective vector by suppressing ϵ.

1. Image partitioning (IP): One solution is to tile the image and perform adversarial attacks on patches separately and then piece together the adversarial patches.
2. SDS: SDS reduces the VRAM occupancy of optimization by modifying the loss function.
3. Alternating iterative framework (AIF): The alternating iterative attack framework we proposed in Sec. 4.1. We apply the framework on AdvDM to ensure that the performance improvement comes from AIF but not other modules.

Table 4 shows the quantitative results of the three solutions when edit strength is 0.3. Alternating iterative framework reduces the VRAM demand while maintaining attack effect since it is mathematically equivalent to the attack process of AdvDM.

Validation of Cosine Loss

Figure 9 shows how the cosine similarity loss mitigates the side effect. The timestep is fixed at t = 100 to provide stable visualization. Figure 9a visualizes the trajectory of ϵθ during optimizations, where the ground-truth ϵt is mapped to the coordinate (-1, 0). Optimizing the cosine loss does not lead to the growth of ϵθ compared to ℓ2 loss. Figure 9b shows the curve of the magnitude of effective vector δ - ϵpθ . Maximizing the ℓ2 loss even shortens the effective vector. Figure 9c presents the magnitudes of vectors after 100 steps of optimizations. The growth of ϵθ is suppressed and the magnitude of the effective vector is increased by maximizing the cosine loss. It can be clearly observed that optimizing the cosine similarity loss reduces the side effects of ϵpθ by suppressing ϵθ, thus ensuring the growth of effective vectors.

6 Conclusion

In this paper, we propose an alternating iterative attack framework that reduces VRAM demands without sacrificing performance. Based on the framework, we provide a mathematical analysis of the cancellation effect between perturbations and the denoiser. To mitigate this side effect and enhance attack effectiveness, we introduce a cosine similarity loss to address the limitations of the conventional ℓ2 loss. Furthermore, by interpreting attacks on LDMs at multiple timesteps as an ensemble attack, we propose a grouped gradient ensemble strategy to better exploit complementary information across timesteps. In addition, we improve optimization stability by fixing the Gaussian noise during the attack process.