Copying reference images limits harmful photo edits in AI tools
Copying As Defense: Protecting Images from Editing By Eliciting Model Copying
Computer Vision and Pattern Recognition
Summary
AI image editors can change photos in realistic but sometimes harmful ways. The authors found that making the AI focus more on copying the original image, rather than following edit instructions, stops most unwanted edits. They created a method that gently nudges the AI to copy early on, which reduces successful manipulations by over 70%. This defense also works faster and better than previous techniques.
What this means in practice
- •For social media platforms: Integrate a defense to proactively protect user photos from unauthorized AI-driven edits by making editing models copy original images instead of altering them.
- •For digital content moderators: Use the method to detect or prevent harmful or non-consensual AI edits by constraining model attention early in image editing pipelines.
Authors
Salma Abdel Magid, Sanghyuk Chun, Eric Slyman, Kushal Kafle, Olga Russakovsky
Abstract
Image editors built on diffusion transformers (DiTs), such as Flux Kontext, make it possible to turn a single photograph into a convincing manipulated image, including harmful and non-consensual edits. Proactive defenses aim to prevent such manipulations by adding an imperceptible perturbation before an image is shared. Existing defenses for DiT-based in-context editors make the output attend less to the protected reference image. But this leaves the model free to follow the edit instruction using the text and its own generated tokens, often producing a new, weakly grounded image rather than preventing the edit. We find that the opposite strategy is more effective: instead of leading the model to ignore the reference, we encourage it to copy it. Through controlled attention interventions, we show that concentrating target-token attention on the reference image in only a few early blocks is sufficient to collapse the editing behavior, causing the model to reproduce its input, often as a lossy copy, rather than execute the requested transformation. Based on this insight, we introduce Copying-as-Defense (CaD), which maximizes per-token target-to-reference attention mass in early transformer blocks. Since attention rows are normalized, increasing reference attention suppresses the attention allocated to the text and generated canvas. Restricting the objective to early blocks also lets us truncate the backpropagation path, keeping optimization cheap. Across editors and benchmarks, CaD reduces average edit success from 81.4% on unprotected images to 24.0%, a 70.6% relative reduction, and by a further 44.3% relative to DeContext, the strongest baseline (43.0%). CaD is also roughly 1.8-2.0x faster per optimization step than comparable methods.