Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
PreprintCited by 2

The DOI matches its DataCite record, with a small difference in title or year; 3 of the 3 references it cites were found in a registry or an index.

Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models

Shan, Shawn, Cryan, Jenna, Wenger, Emily, Zheng, Haitao, Hanocka, Rana, Zhao, Ben Y.·2023·arXiv
DOI 10.48550/arxiv.2302.04222arXiv 2302.04222
Open this paper in CoChat — free account

Abstract

Recent text-to-image diffusion models such as MidJourney and Stable Diffusion threaten to displace many in the professional artist community. In particular, models can learn to mimic the artistic style of specific artists after "fine-tuning" on samples of their art. In this paper, we describe the design, implementation and evaluation of Glaze, a tool that enables artists to apply "style cloaks" to their art before sharing online. These cloaks apply barely perceptible perturbations to images, and when used as training data, mislead generative models that try to mimic a specific artist. In coordination with the professional artist community, we deploy user studies to more than 1000 artists, assessing their views of AI art, as well as the efficacy of our tool, its usability and tolerability of perturbations, and robustness across different scenarios and against adaptive countermeasures. Both surveyed artists and empirical CLIP-based scores show that even at low perturbation levels (p=0.05), Glaze is highly successful at disrupting mimicry under normal conditions (>92%) and against adaptive countermeasures (>85%).

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2302.04222

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Figures

Figure 1 Sample AI-generated art pieces from the Midjourney community showcase [53,69].
Figure 1 Sample AI-generated art pieces from the Midjourney community showcase [53,69].CC-BY · From the PDF
Image 2
CC-BY · From the PDF
Image 3
CC-BY · From the PDF
Figure 3 High level model architecture of text-to-image models.
Figure 3 High level model architecture of text-to-image models.CC-BY · From the PDF
Figure 4 High level overview of the mimicry attack scenario. The mimic scrapes copyrighted artwork from the victim artist and uses these to fine-tune a pre-trained, generic text-to-image model. The generic model is trained and open-sourced by an AI company. The mimic then uses the fine-tuned model to generate artwork in the style of the victim artist.
Figure 4 High level overview of the mimicry attack scenario. The mimic scrapes copyrighted artwork from the victim artist and uses these to fine-tune a pre-trained, generic text-to-image model. The generic model is trained and open-sourced by an AI company. The mimic then uses the fine-tuned model to generate artwork in the style of the victim artist.CC-BY · From the PDF
Figure 5 Overview of Glaze , a system that protects victim artists from AI style mimicry by cloaking their online artwork. ( Top ) An artist V applies the cloaking algorithm (uses a feature extractor Φ and a target style T ) to generate cloaked versions of V 's art pieces. Each cloak is a small perturbation unnoticeable to human eye. ( Bottom ) A mimic scrapes the cloaked art pieces from online and uses them to fine-tune a model to mimic V 's style. When prompted to generate artwork in the style of V , mimic's model will generate artwork in the target style T , rather than V 's true style.
Figure 5 Overview of Glaze , a system that protects victim artists from AI style mimicry by cloaking their online artwork. ( Top ) An artist V applies the cloaking algorithm (uses a feature extractor Φ and a target style T ) to generate cloaked versions of V 's art pieces. Each cloak is a small perturbation unnoticeable to human eye. ( Bottom ) A mimic scrapes the cloaked art pieces from online and uses them to fine-tune a model to mimic V 's style. When prompted to generate artwork in the style of V , mimic's model will generate artwork in the target style T , rather than V 's true style.CC-BY · From the PDF
Figure 6 High level overview of how Glaze perturbs the style-specific features of the artwork. a) Glaze style transfers the original artwork to a different style, which changes its style but leaves other features unaltered. b) Glaze optimizes a cloak that makes the artwork's features representation match that of the style-transferred art, while constraining the amount of visible changes to the artwork.
Figure 6 High level overview of how Glaze perturbs the style-specific features of the artwork. a) Glaze style transfers the original artwork to a different style, which changes its style but leaves other features unaltered. b) Glaze optimizes a cloak that makes the artwork's features representation match that of the style-transferred art, while constraining the amount of visible changes to the artwork.CC-BY · From the PDF
Figure 7 Example style-transferred artwork with different target styles.
Figure 7 Example style-transferred artwork with different target styles.CC-BY · From the PDF
Figure 8 Example Glaze protection results for three artists. Columns 1-2 : artist's original artwork; column 3 : mimicked artwork when artist does not use protection; column 4 : style-transferred artwork (original artwork in column 1 is the source) used for cloak optimization and the name of target style; column 5-6 : mimicked artwork when artist uses cloaking protection with perturbation budget p = 0 . 05 or p = 0 . 1 respectively. All mimicry examples here use SD-based models.
Figure 8 Example Glaze protection results for three artists. Columns 1-2 : artist's original artwork; column 3 : mimicked artwork when artist does not use protection; column 4 : style-transferred artwork (original artwork in column 1 is the source) used for cloak optimization and the name of target style; column 5-6 : mimicked artwork when artist uses cloaking protection with perturbation budget p = 0 . 05 or p = 0 . 1 respectively. All mimicry examples here use SD-based models.CC-BY · From the PDF
Figure 9 Glaze 's cloaking protection success increases as cloak perturbation budget increases. The top row of the figure shows baseline performance with the mimic trains on uncloaked images (p=0).
Figure 9 Glaze 's cloaking protection success increases as cloak perturbation budget increases. The top row of the figure shows baseline performance with the mimic trains on uncloaked images (p=0).CC-BY · From the PDF
Figure 10 Artists' willingness to post cloaked artwork in place of the original decreases as perturbation budget of the cloaks increases.
Figure 10 Artists' willingness to post cloaked artwork in place of the original decreases as perturbation budget of the cloaks increases.CC-BY · From the PDF
Figure 11 Original artwork and cloaked artwork computed using three different cloak perturbation budgets.
Figure 11 Original artwork and cloaked artwork computed using three different cloak perturbation budgets.CC-BY · From the PDF
Figure 12 Glaze remains successful under two challenging scenarios. Left: when artist and mimic use different feature extractors. Right: when artists can only cloak a portion of their artwork in mimic's dataset. Bottom of the figure shows artist-rated PSR and CLIP-based genre shift for the corresponding setting.
Figure 12 Glaze remains successful under two challenging scenarios. Left: when artist and mimic use different feature extractors. Right: when artists can only cloak a portion of their artwork in mimic's dataset. Bottom of the figure shows artist-rated PSR and CLIP-based genre shift for the corresponding setting.CC-BY · From the PDF
Figure 13 Glaze 's protection performance remains high as mimic adds an increasing amount of Gaussian noise to the cloaked artwork. Even when the mimic adds denoising (last column), Glaze 's protection persists.
Figure 13 Glaze 's protection performance remains high as mimic adds an increasing amount of Gaussian noise to the cloaked artwork. Even when the mimic adds denoising (last column), Glaze 's protection persists.CC-BY · From the PDF
Figure 14 Glaze 's protection performance remains high as mimic adds JPEG compression to the cloaked artwork. Even when the mimic also upscales the mimicked images (last column), Glaze 's protection persists.
Figure 14 Glaze 's protection performance remains high as mimic adds JPEG compression to the cloaked artwork. Even when the mimic also upscales the mimicked images (last column), Glaze 's protection persists.CC-BY · From the PDF
Figure 15 Glaze 's protection performance remains high against robust training countermeasure proposed by Radiya et al. . The protection performance first decreases then increases as mimic robustly trains the model with an increasing number of steps.
Figure 15 Glaze 's protection performance remains high against robust training countermeasure proposed by Radiya et al. . The protection performance first decreases then increases as mimic robustly trains the model with an increasing number of steps.CC-BY · From the PDF
Plagiarized art by PEZ
Plagiarized art by PEZCC-BY · From the PDF
Figure 16 Glazed image and generated image from PEZ mimicry method. The original image is Musa Victoriosa , a new painting created by Karla Ortiz to be the first artwork to be released publicly under Glaze protection.
Figure 16 Glazed image and generated image from PEZ mimicry method. The original image is Musa Victoriosa , a new painting created by Karla Ortiz to be the first artwork to be released publicly under Glaze protection.CC-BY · From the PDF
Image 19
CC-BY · From the PDF
Image 20
CC-BY · From the PDF
Figure 18 Example data used for fine-tuning, including artwork from different artists and their text captions.
Figure 18 Example data used for fine-tuning, including artwork from different artists and their text captions.CC-BY · From the PDF
Figure 21 Comparing performance of art mimicry directly using a generic model to that of mimicry on a model that has been fine-tuned on the victim's art pieces. Column 1-2 : artists' original artwork; column 3-4 : plagiarized artwork generated from a style-specific model finetuned on artist's art; column 5-6 : plagiarized artwork generated from the generic SD model using the artist's name as prompt.
Figure 21 Comparing performance of art mimicry directly using a generic model to that of mimicry on a model that has been fine-tuned on the victim's art pieces. Column 1-2 : artists' original artwork; column 3-4 : plagiarized artwork generated from a style-specific model finetuned on artist's art; column 5-6 : plagiarized artwork generated from the generic SD model using the artist's name as prompt.CC-BY · From the PDF
Figure 20 Mimicked artwork when artist uses an increasingly high perturbation budget to protect their original art.
Figure 20 Mimicked artwork when artist uses an increasingly high perturbation budget to protect their original art.CC-BY · From the PDF
Figure 22 Comparing protection levels provided by different cloaking systems, including adapted versions of Fawkes, Lowkey, and Photoguard for style protection. Glaze significantly outperforms these adapted alternatives.
Figure 22 Comparing protection levels provided by different cloaking systems, including adapted versions of Fawkes, Lowkey, and Photoguard for style protection. Glaze significantly outperforms these adapted alternatives.CC-BY · From the PDF
Figure 23 Additional example Glaze protection results for four artists. Columns 1-2 : artist's original artwork; column 3-4 : plagiarized artwork when artist does not use protection; column 5-6 : plagiarized artwork when artist uses cloaking protection with perturbation budget p = 0 . 05. All mimicry attempts use SD-based models.
Figure 23 Additional example Glaze protection results for four artists. Columns 1-2 : artist's original artwork; column 3-4 : plagiarized artwork when artist does not use protection; column 5-6 : plagiarized artwork when artist uses cloaking protection with perturbation budget p = 0 . 05. All mimicry attempts use SD-based models.CC-BY · From the PDF

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Research works printed but not linked: 62

  1. BALAJI, Y., ET AL. ediffi: Text-to-image diffusion models with an ensemble of expert denoisers. arXiv:2211.01324 (2022). · arXiv
  2. BLAU, Y., AND MICHAELI, T. The perception-distortion tradeoff. In Proc. of CVPR (2018).
  3. CARLINI, N., AND WAGNER, D. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proc. of AISec (2017).
  4. CARLINI, N., AND WAGNER, D. Towards evaluating the robustness of neural networks. In Proc. of IEEE S&P (2017).
  5. CHANDRASEKARAN, V., ET AL. Face-off: Adversarial face obfusca- tion. PETS 2 (2020), 369-390.
  6. CHANGPINYO, S., SHARMA, P., DING, N., AND SORICUT, R. Con- ceptual 12m: Pushing web-scale image-text pre-training to recognize long-tail visual concepts. In Proc. of CVPR (2021).
  7. CHEN, W., HU, H., SAHARIA, C., AND COHEN, W. W. Re-imagen: Retrieval-augmented text-to-image generator. arXiv:2209.14491 (2022). · arXiv
  8. CHEREPANOVA, V., ET AL. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. In ICLR (2021).
  9. DAYMA, B. DALLE Mega -Training Journal, 2022.
  10. DEMONTIS, A., ET AL. Why do adversarial attacks transfer? ex- plaining transferability of evasion and poisoning attacks. In Proc. of USENIX Security (2019).
  11. DENG, J., DONG, W., SOCHER, R., LI, L.-J., LI, K., AND FEI-FEI, L. Imagenet: A large-scale hierarchical image database. In Proc. of CVPR (2009).
  12. FEINMAN, R., CURTIN, R. R., SHINTRE, S., AND GARDNER, A. B. Detecting adversarial samples from artifacts. arXiv:1703.00410 (2017). · arXiv
  13. GAL, R., ET AL. An image is worth one word: Personalizing text-to- image generation using textual inversion. arXiv:2208.01618 (2022). · arXiv
  14. GONDIM-RIBEIRO, G., TABACOF, P., AND VALLE, E. Adversarial attacks on variational autoencoders. arXiv:1806.04646 (2018). · arXiv
  15. HEIKKILA, M. This artist is dominating AI-generated art. and he's not happy about it. MIT Technology Review, Sept 2022.
  16. KARRAS, T., ET AL. Training generative adversarial networks with limited data. In Proc. of NeurIPS (2020).
  17. KAWAR, B., ET AL. Imagic: Text-based real image editing with diffusion models. Proc. of CVPR (2023).
  18. KE, Y., ET AL. Efficient near-duplicate detection and sub-image retrieval. In Proc. of MM (2004).
  19. KOS, J., FISCHER, I., AND SONG, D. Adversarial examples for generative models. In Proc. of SPW (2018).
  20. KYNKÄÄNNIEMI, T., KARRAS, T., AITTALA, M., AILA, T., AND LEHTINEN, J. The role of imagenet classes in fréchet inception distance. arXiv:2203.06026 (2022). · arXiv
  21. LAIDLAW, C., SINGLA, S., AND FEIZI, S. Perceptual adversarial robustness: Defense against unseen threat models. arXiv:2006.12655 (2020). · arXiv
  22. LI, K.-L., HUANG, H.-K., TIAN, S.-F., AND XU, W. Improving one-class SVM for anomaly detection. In Proc. of IEEE CAT (2003).
  23. LI, W., ET AL. Object-driven text-to-image synthesis via adversarial training. In Proc. of CVPR (2019).
  24. LI, Y., FAN, H., HU, R., FEICHTENHOFER, C., AND HE, K. Scaling language-image pre-training via masking. arXiv:2212.00794 (2022). · arXiv
  25. LIU, Z., LUO, P., WANG, X., AND TANG, X. Deep learning face attributes in the wild. In Proc. of ICCV (Dec. 2015).
  26. LUO, Z., XI, Y., ZHANG, R., AND MA, J. VC-GPT: Visual con- ditioned GPT for end-to-end generative vision-and-language pre- training. arXiv:2201.12723 (2022). · arXiv
  27. MANSIMOV, E., PARISOTTO, E., BA, J. L., AND SALAKHUTDINOV, R. Generating images from captions with attention. arXiv:1511.02793 (2015). · arXiv
  28. MENG, C., ET AL. On distillation of guided diffusion models. arXiv:2210.03142 (2022). · arXiv
  29. PAPERNOT, N., MCDANIEL, P., AND GOODFELLOW, I. Transfer- ability in machine learning: From phenomena to black-box attacks using adversarial samples. arXiv:1605.07277 (2016). · arXiv
  30. RADFORD, A., ET AL. Learning transferable visual models from natural language supervision. In Proc. of ICML (2021).
  31. RADFORD, A., METZ, L., AND CHINTALA, S. Unsupervised rep- resentation learning with deep convolutional generative adversarial networks. arXiv:1511.06434 (2015). · arXiv
  32. RADIYA-DIXIT, E., ET AL. Data poisoning won't save you from facial recognition. arXiv:2106.14851 (2021). · arXiv
  33. RAMESH, A., ET AL. Zero-shot text-to-image generation. In Proc. of ICML (2021).
  34. RAMESH, A., ET AL. Hierarchical text-conditional image generation with clip latents. arXiv:2204.06125 (2022). · arXiv
  35. ROMBACH, R., ET AL. High-resolution image synthesis with latent diffusion models. In Proc. of CVPR (2022).
  36. RONY, J., GRANGER, E., PEDERSOLI, M., AND BEN AYED, I. Aug- mented lagrangian adversarial attacks. In Proc. of ICCV (2021).
  37. SABOUR, S., CAO, Y., FAGHRI, F., AND FLEET, D. J. Adversarial manipulation of deep representations. arXiv:1511.05122 (2015). · arXiv
  38. SAHARIA, C., ET AL. Palette: Image-to-image diffusion models. In Proc. of SIGGRAPH (2022).
  39. SALEH, B., AND ELGAMMAL, A. Large-scale classification of fine-art paintings: Learning the right metric on the right feature. arXiv:1505.00855 (2015). · arXiv
  40. SALEHI, M., ET AL. Arae: Adversarially robust training of autoen- coders improves novelty detection. Neural Networks 144 (2021), 726-736.
  41. SALMAN, H., KHADDAJ, A., LECLERC, G., ILYAS, A., AND MADRY, A. Raising the cost of malicious AI-powered image editing. arXiv:2302.06588 (2022). · arXiv
  42. SHAN, S., DING, W., WENGER, E., ZHENG, H., AND ZHAO, B. Y. Post-breach recovery: Protection against white-box adversarial exam- ples for leaked dnn models. In Proc. of ACM CCS (2022).
  43. SHAN, S., WENGER, E., WANG, B., LI, B., ZHENG, H., AND ZHAO, B. Y. Gotta catch'em all: Using honeypots to catch adversarial attacks on neural networks. In Proc. of ACM CCS (2020).
  44. SHAN, S., WENGER, E., ZHANG, J., LI, H., ZHENG, H., AND ZHAO, B. Y. Fawkes: Protecting privacy against unauthorized deep learning models. In Proc. of USENIX Security (2020).
  45. SHARMA, P., DING, N., GOODMAN, S., AND SORICUT, R. Con- ceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In Proc. of ACL (2018).
  46. SUCIU, O., ET AL. When does machine learning fail? generalized transferability for evasion and poisoning attacks. In Proc. of USENIX Security (2018).
  47. TABACOF, P., TAVARES, J., AND VALLE, E. Adversarial images for variational autoencoders. arXiv:1612.00155 (2016). · arXiv
  48. TAO, M., ET AL. DF-GAN: A simple and effective baseline for text-to-image synthesis. In Proc. of CVPR (2022).
  49. THOMEE, B., ET AL. Yfcc100m: The new data in multimedia re- search. CACM 59, 2 (2016), 64-73.
  50. UPCHURCH, P., ET AL. Deep feature interpolation for image content changes. In Proc. of CVPR (2017).
  51. WANG, B., YAO, Y., SHAN, S., LI, H., VISWANATH, B., ZHENG, H., AND ZHAO, B. Y. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proc. of IEEE S&P (2019).
  52. WANG, F., AND LIU, H. Understanding the behaviour of contrastive loss. In Proc. of CVPR (2021).
  53. WEN, Y., ET AL. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. arXiv:2302.03668 (2023). · arXiv
  54. WENGER, E., SHAN, S., ZHENG, H., AND ZHAO, B. Y. SoK: Anti- facial recognition technology. In Proc. of IEEE S&P (2023).
  55. WHITE, T. Sampling generative networks. arXiv:1609.04468 (2016). · arXiv
  56. XU, T., ET AL. Attngan: Fine-grained text to image generation with attentional generative adversarial networks. In Proc. of CVPR (2018).
  57. YOSINSKI, J., CLUNE, J., BENGIO, Y., AND LIPSON, H. How trans- ferable are features in deep neural networks? In Proc. of NeurIPS (2014).
  58. ZHANG, H., AVRITHIS, Y., FURON, T., AND AMSALEG, L. Smooth adversarial examples. EURASIP Journal on Information Security (2020), 1-12.
  59. ZHANG, H., ET AL. Stackgan: Text to photo-realistic image synthe- sis with stacked generative adversarial networks. In Proc. of ICCV (2017).
  60. ZHANG, K., ET AL. Beyond a Gaussian denoiser: Residual learning of deep CNN for image denoising. IEEE Trans. on Image Processing (2017), 3142-3155.
  61. ZHANG, R., ET AL. The unreasonable effectiveness of deep features as a perceptual metric. In Proc. of CVPR (2018).
  62. ZHU, M., PAN, P., CHEN, W., AND YANG, Y. Dm-gan: Dynamic memory generative adversarial networks for text-to-image synthesis. In Proc. of CVPR (2019).

Cited by

See all 2

Metadata

Authors
Shan, S., Cryan, J., Wenger, E., Zheng, H., Hanocka, R., & Zhao, B. Y.
Venue
arXiv
Publisher
arXiv
Published
2023
DOI
10.48550/arxiv.2302.04222
arXiv
2302.04222
References
3
Type
Preprint
Licence
creativecommons.org/licenses/by/4.0/legalcode

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review