对抗性保护图像在压缩后仍有效，防止深伪生成。
MetaCloak-JPEG: JPEG-Robust Adversarial Perturbation for Preventing Unauthorized DreamBooth-Based Deepfake Generation
- 引入可微分JPEG层，让对抗扰动穿过压缩环节
- 压缩后保留91.3%保护信号，PSNR达32.7 dB
- 适合社交媒体图像防护，尤其应对平台压缩
基于文本到图像生成的深度伪造技术（如DreamBooth）仅需4-8张公开人脸图即可生成逼真有害内容。现有保护系统（PhotoGuard、Anti-DreamBooth、MetaCloak）无法应对社交平台普遍采用的JPEG压缩，因压缩中的round()操作导致梯度消失，使60-80%的对抗信号被丢弃。本文提出MetaCloak-JPEG，通过可微分JPEG（DiffJPEG）层（基于直通估计器），在前向传播中执行标准压缩，反向传播时用恒等函数替代round()。该模块嵌入于约70%含DiffJPEG的增强策略，并结合质量因子从95降至50的课程学习策略，在双层元学习框架中优化。在l-inf扰动预算eps=8/255下，实现32.7 dB PSNR，91.3% JPEG生存率，优于PhotoGuard在全部9个质量因子上的表现（9胜，平均去噪损失提升+0.125），训练内存仅4.1 GB。
原文摘要 · Abstract (English)
The rapid progress of subject-driven text-to-image synthesis, and in particular DreamBooth, has enabled a consent-free deepfake pipeline: an adversary needs only 4-8 publicly available face images to fine-tune a personalized diffusion model and produce photorealistic harmful content. Current adversarial face-protection systems -- PhotoGuard, Anti-DreamBooth, and MetaCloak -- perturb user images to disrupt surrogate fine-tuning, but all share a structural blindness: none backpropagates gradients through the JPEG compression pipeline that every major social-media platform applies before adversary access. Because JPEG quantization relies on round(), whose derivative is zero almost everywhere, adversarial energy concentrates in high-frequency DCT bands that JPEG discards, eliminating 60-80% of the protective signal. We introduce MetaCloak-JPEG, which closes this gap by inserting a Differentiable JPEG (DiffJPEG) layer built on the Straight-Through Estimator (STE): the forward pass applies standard JPEG compression, while the backward pass replaces round() with the identity. DiffJPEG is embedded in a JPEG-aware EOT distribution (~70% of augmentations include DiffJPEG) and a curriculum quality-factor schedule (QF: 95 to 50) inside a bilevel meta-learning loop. Under an l-inf perturbation budget of eps=8/255, MetaCloak-JPEG attains 32.7 dB PSNR, a 91.3% JPEG survival rate, and outperforms PhotoGuard on all 9 evaluated JPEG quality factors (9/9 wins, mean denoising-loss gain +0.125) within a 4.1 GB training-memory budget.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。