Stable Diffusion (SD) customization approaches enable users to personalize SD
model outputs, greatly enhancing the flexibility and diversity of AI art.
However, they also allow individuals to plagiarize specific styles or subjects
from copyrighted images, which raises significant concerns about potential
copyright infringement. To address this issue, we propose an invisible
data-free universal adversarial watermark (DUAW), aiming to protect a myriad of
copyrighted images from different customization approaches across various
versions of SD models. First, DUAW is designed to disrupt the variational
autoencoder during SD customization. Second, DUAW operates in a data-free
context, where it is trained on synthetic images produced by a Large Language
Model (LLM) and a pretrained SD model. This approach circumvents the necessity
of directly handling copyrighted images, thereby preserving their
confidentiality. Once crafted, DUAW can be imperceptibly integrated into
massive copyrighted images, serving as a protective measure by inducing
significant distortions in the images generated by customized SD models.
Experimental results demonstrate that DUAW can effectively distort the outputs
of fine-tuned SD models, rendering them discernible to both human observers and
a simple classifier.

通过使用不可见的无数据普适对抗水印（DUAW），本研究提出了一种保护众多版权图像免受不同自定义方法和不同版本的 Stable Diffusion (SD) 模型侵权的方法。DUAW 的设计目的是干扰 Stable Diffusion 定制过程中的变分自编码器，它在一个无数据的环境中操作，通过对由大型语言模型（LLM）和预训练的 SD 模型产生的合成图像进行训练。该方法规避了直接处理受版权保护图像的必要性，从而保护了其机密性。实验证明，DUAW 能够有效地扭曲精细调整的 SD 模型的输出，使其对人类观察者和简单分类器都可分辨出来。

DUAW：无需数据的通用对抗水印技术对抗稳定扩散自定义

DUAW: Data-free Universal Adversarial Watermark against Stable Diffusion  Customization

Owing to the unrestricted nature of the content in the training data, large
text-to-image diffusion models, such as Stable Diffusion (SD), are capable of
generating images with potentially copyrighted or dangerous content based on
corresponding textual concepts information. This includes specific intellectual
property (IP), human faces, and various artistic styles. However, Negative
Prompt, a widely used method for content removal, frequently fails to conceal
this content due to inherent limitations in its inference logic. In this work,
we propose a novel strategy named \textbf{Degeneration-Tuning (DT)} to shield
contents of unwanted concepts from SD weights. By utilizing Scrambled Grid to
reconstruct the correlation between undesired concepts and their corresponding
image domain, we guide SD to generate meaningless content when such textual
concepts are provided as input. As this adaptation occurs at the level of the
model's weights, the SD, after DT, can be grafted onto other conditional
diffusion frameworks like ControlNet to shield unwanted concepts. In addition
to qualitatively showcasing the effectiveness of our DT method in protecting
various types of concepts, a quantitative comparison of the SD before and after
DT indicates that the DT method does not significantly impact the generative
quality of other contents. The FID and IS scores of the model on COCO-30K
exhibit only minor changes after DT, shifting from 12.61 and 39.20 to 13.04 and
38.25, respectively, which clearly outperforms the previous methods.

通过使用一种名为 Degeneration-Tuning (DT) 的新策略，本研究提出了一种方法来保护文本到图像扩散模型中不需要的概念内容，同时对其他内容的生成质量影响较小。