Notice: The reproducibility variables underlying each score are classified using an automated LLM-based pipeline, validated against a manually labeled dataset. LLM-based classification introduces uncertainty and potential bias; scores should be interpreted as estimates. Full accuracy metrics and methodology are described in Coakley et alK. L. Coakley, T. Snelleman, H. Hoos, and O. E. Gundersen, "The embrace of open science: An analysis of a decade of AI research and 56 800 conference papers," Under Review, 2026..
BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing
Authors: Jinsu Kim, Yunhun Nam, Minseon Kim, Sangpil Kim, Jongheon Jeong
NeurIPS 2025 | Venue PDF | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Through extensive experiments, we show that our method consistently improves the per-sample worst-case protection performance of existing methods against a wide range of reversal techniques on diverse image editing scenarios, while also reducing quality degradation due to noise in terms of perceptual metrics. |
| Researcher Affiliation | Collaboration | Jinsu Kim1 Yunhun Nam1 Minseon Kim2 Sangpil Kim1 Jongheon Jeong1 1Korea University 2Microsoft Research Montréal EMAIL |
| Pseudocode | Yes | Algorithm 1 Blur Guard Input: source image x; noise budget ϵ; # steps T1, T2; step size γ1, γ2; loss coefficient λ Output: protected image ˆx |
| Open Source Code | Yes | Code is available at https://github.com/jsu-kim/Blur Guard. |
| Open Datasets | Yes | To effectively evaluate image protection performance across diverse cases, we have curated a new, custom subset of 80 image samples taken from Image Net [21], coined Image Net-Edit; more details can be found in Appendix C.3. For the inpainting task, we use the Helen dataset [44], following the pre-processing done by Cao et al. [10]. We use the Wiki Art dataset [89] for the textual inversion task. For the instruction-based editing task with Instruct Pix2Pix [7], we use the Magic Brush [98] dataset... For the Dream Booth [74] tasks in Appendix D.1, we use the VGGFace2 [11] dataset, which is a large-scale face recognition dataset. |
| Dataset Splits | Yes | To effectively evaluate image protection performance across diverse cases, we have curated a new, custom subset of 80 image samples taken from Image Net [21], coined Image Net-Edit; more details can be found in Appendix C.3. For the inpainting task, we use the Helen dataset [44], following the pre-processing done by Cao et al. [10]. Specifically, they curated this dataset by sampling 80 images with the smallest face-to-image ratio to select images that are easy to modify. We randomly sampled 80 images and instructions from the test set of Magic Brush for our experiments. For evaluation, we sample 50 identities in VGGFace2, following the experimental settings of Anti-Dream Booth [90]. |
| Hardware Specification | Yes | We used a single NVIDIA A100 80GB GPU to run most of the experiments conducted; including processes of image protection, purification, and editing images. For fine-tuning Stable Diffusion models as done for the textual inversion experiments, we used a single NVIDIA RTX 3090 GPU, and a single NVIDIA RTX 3070 8GB to run Glaze. |
| Software Dependencies | No | The paper mentions 'Py Torch' but does not specify a version number. It also refers to models and schedulers without providing specific software library versions. |
| Experiment Setup | Yes | For image protection baselines, we consider 4 baseline image protection methods: Adv DM [49], Mist [48], Photo Guard [77], and SDS [96]. We set the noise budget ϵ = 16/255 and step size γ = 2/255 for each iteration of PGD attack. For Photo Guard, we used their encoder attack with no target image as it is the simplest adversarial objective that can be easily integrated with our framework. For image-to-image generation and inpainting, we adopt the hyperparameter settings from Photo Guard: 100 denoising steps, guidance scale of 7.5, and η = 1. For constructing our protection, we optimized the logarithm of the Gaussian blur intensities log σ1, . . . , log σR using the Adam optimizer with a learning rate (γ1) of 0.1 during timesteps of T1 = 50. After optimizing the blur intensities, we then optimize the adversarial perturbation with our l2-normalized PGD attack during timesteps of T2 = 100 as same as other baseline protection methods. As the step size γ2 for optimizing the perturbation δ, we used γ2 = 20 for image-to-image generation and textual inversion task, and γ2 = 50 for inpainting. |