Fragile by Design: Limitations of Adversarial Defenses in Personalized Generation

The researchers propose the AntiDB_Purify evaluation framework and find that existing adversarial defenses against facial identity leakage in personalized generation cannot maintain their protective effect under either image filtering or adversarial purification. The paper points out two overlooked limitations of such defenses: adversarial perturbations often carry perceptible artifacts such as obvious patterns or stripes, making them easy to identify as tampered content; the perturbations are also fragile, and a simple non-learning filter can remove them, restoring the model's ability to memorize and reproduce user identity. The study evaluates existing methods such as Anti-DreamBooth and concludes that they fail under such purification threats; the authors argue this gives users a false sense of security and call for more imperceptible and more robust protection methods.