Safeguarding Text-to-Image Generative Models Against Unauthorized Knowledge Distillation Yilan Gao1 , Sida Huang1,2 , Hongyuan Zhang3 * , Xuelong Li2 * 1
arXiv:2605.22060v1 [cs.CR] 21 May 2026
School of Artificial Intelligence, OPtics and ElectroNics (iOPEN), Northwestern Polytechnical University, Xi’an 710072, P. R. China 2 Institute of Artificial Intelligence (TeleAI), China Telecom, P. R. China 3 The University of Hong Kong [email protected], [email protected], [email protected], xuelong [email protected] Abstract Closed-weight generative services are increasingly deployed through query-based APIs, where users can obtain generated outputs while model parameters remain inaccessible. However, such deployment does not prevent model stealing: an attacker can repeatedly query the service, collect large volumes of released synthetic images, and use them as training data for a private substitute model. This query-output-driven process enables unauthorized knowledge distillation and capability replication without direct access to the original weights. To mitigate this threat, a practical defense should preserve the visual fidelity of released images, provide explicit control over perturbation magnitude, and scale efficiently to largevolume output release. We present WaveGuard, a singlepass, generator-based protection framework that safeguards released synthetic images under a user-specified perturbation budget. WaveGuard employs a frequency-aware perturbation generator to inject structured, imperceptible perturbations that maintain perceptual utility for benign viewers while reducing the usefulness of protected images as training data for unauthorized student models. Extensive experiments under WikiArt-related synthetic-output distillation settings show that WaveGuard achieves a favorable efficacy–fidelity– efficiency trade-off, with explicit imperceptibility control and substantial gains in protection efficiency.
1
Introduction
Generative models (Song, Meng, and Ermon 2021; Podell et al. 2024; Huang et al. 2025; Gu et al. 2026) have become powerful tools for image synthesis (Huang et al. 2026), personalization, and creative content generation (Zhu et al. 2025). In practical deployments, model owners often expose these systems through closed-weight services: users can query the service and obtain generated outputs, while the model parameters remain private. However, keeping the weights inaccessible does not eliminate the risk of model stealing (Ma et al. 2021). Since generated images themselves encode the visual knowledge, stylistic patterns, and generation capability of the service, an attacker can repeatedly query the model, collect a large number of released outputs, and use them as training data for a private substitute model. This threat differs from conventional model stealing scenarios that mainly exploit prediction labels, logits, or deci* Corresponding author.
Figure 1: Unauthorized distillation from released synthetic images and WaveGuard protection. (Left) An attacker queries a closed-weight generative service, collects released synthetic images, and trains a substitute model to imitate the teacher. (Right) WaveGuard applies bounded, structured perturbations before release, reducing downstream imitation while preserving visual fidelity.
sion boundaries. For generative models, the released samples can directly serve as supervision for downstream training. In this setting, unauthorized distillation does not require access to the teacher model’s weights, training data, or internal representations; instead, the attacker distills knowledge from the synthetic outputs exposed by the service. The resulting substitute model may imitate the teacher’s visual style or generation behavior, causing intellectual property infringement and weakening the protection offered by closed-weight deployment. In this work, we focus on image generative services and study this threat as unauthorized knowledge distillation from released synthetic images. A practical defense for this setting must satisfy several deployment-oriented requirements. First, it should reduce the usefulness of released images for unauthorized substitute training. Second, it should preserve the visual fidelity of the released outputs, since these images are still intended for benign users or public presentation. Third, it should provide explicit control over perturbation magnitude, so that the protection strength can be adjusted according to a userspecified imperceptibility budget. Finally, it should scale to large-volume output release, where expensive per-image optimization becomes impractical.
Existing protection methods only partially satisfy these requirements. Watermarking-oriented methods (Cui et al. 2025; Zhao et al. 2023) are useful for attribution, ownership verification, or post-hoc tracing, but they do not directly prevent released images from being reused as training data. Diffusion-oriented anti-personalization methods (Ye et al. 2024; Liang and Wu 2023; Li et al. 2025a; Le et al. 2023) demonstrate that adversarial perturbations can disrupt downstream fine-tuning, yet they typically require iterative perimage optimization at protection time. Such methods can achieve strong disruption, but their computational cost limits their applicability when a large number of generated outputs must be protected before release. Generator-based defenses (Zhu, Takahashi, and Kataoka 2024) improve efficiency by producing perturbations in a forward pass, but they may provide limited explicit perturbation control, introduce visible artifacts, or suffer from unstable optimization. Therefore, existing methods do not simultaneously provide effective disruption, visual fidelity, explicit budget control, and deployment-level efficiency. To address this gap, we propose WaveGuard, an outputlevel, generator-based protection framework for released synthetic images. WaveGuard aims to preserve the perceptual utility of synthetic images for benign viewers while reducing their utility as training data for unauthorized student models. Given a clean generated image and a user-specified perturbation budget, WaveGuard produces a protected image in a single forward pass. Its frequency-aware perturbation generator injects structured, bounded perturbations that remain visually mild in pixel space but alter the latent training signals extracted by downstream substitute models. By enforcing a hard ℓ∞ budget, WaveGuard provides explicit imperceptibility control and supports a practical fidelity– protection–efficiency trade-off for public release scenarios. Our contributions are threefold. First, we formulate unauthorized distillation from released synthetic images as a practical threat to closed-weight image generative services, and identify output-level protection as a deployable defense setting. Second, we introduce WaveGuard, a single-pass, generator-based protection framework that enforces an explicit ℓ∞ perturbation budget and uses frequency-aware perturbation generation to preserve visual fidelity while disrupting downstream substitute training. Third, through extensive experiments under WikiArt-related unauthorized imitation settings, we show that WaveGuard achieves a favorable efficacy–fidelity–efficiency trade-off compared with representative defenses, and further analyze its transferability and robustness under attacker-side preprocessing.
2 2.1
Related Work
Text-to-Image Generative Models
Diffusion models (Dhariwal and Nichol 2021; Ho, Jain, and Abbeel 2020; Rombach et al. 2022) have become the dominant framework for text-to-image synthesis, with latent diffusion models (LDMs) (Rombach et al. 2022) enabling efficient high-resolution generation in a compressed latent space. Built on these generative backbones, lightweight adaptation and personalization methods, such as Textual In-
version (Gal et al. 2022), DreamBooth (Ruiz et al. 2023), LoRA (Hu et al. 2022), and Custom Diffusion (Kumari et al. 2023), allow models to rapidly absorb new concepts, identities, and visual patterns from a small number of examples. Furthermore, controllable generation is facilitated by modular mechanisms like ControlNet (Zhang, Rao, and Agrawala 2023) and T2I-Adapter (Mou et al. 2024), which provide extra guidance via auxiliary pathways. Collectively, these advancements (Park, Ko, and Jang 2023; Chung, Hyun, and Heo 2024) allow for the seamless encoding of unique aesthetics and artistic styles into customized models. While these techniques were originally developed for controllable generation and reuse, they also make it easier for an attacker to train a private substitute model from collected synthetic outputs, turning released images into potential distillation data.
2.2
Adversarial Protection for Diffusion Models
Recent work studies adversarial protection against downstream personalization and fine-tuning (Shan et al. 2023a; Salman et al. 2023; Liu et al. 2023; Hu et al. 2025). A large class of defenses is optimization-based: perturbations are computed per image through iterative procedures that interfere with diffusion denoising or latent representations (Shan et al. 2023b; Liang et al. 2023; Liang and Wu 2023; Le et al. 2023; Li et al. 2025a). These methods often provide strong disruption, but their computational cost can be prohibitive for large-scale output release. Generator-based defenses such as AdvWM (Zhu, Takahashi, and Kataoka 2024) improve throughput, but practical deployment still requires explicit budget control and strong fidelity guarantees. Our work targets this latter regime: fast output-level protection for released synthetic assets rather than maximumdisruption optimization alone.
2.3
Anti-Distillation and Model Protection
Knowledge distillation is widely used for model compression and transfer, but the same teacher–student learning paradigm can also enable model stealing when teacher outputs are exposed to untrusted learners. Early anti-distillation studies mainly focus on discriminative classifiers, where the defender modifies the supervision signal disclosed to the student, such as soft labels, sparse logits, or adversarially perturbed outputs, so that the teacher remains useful for its intended task while becoming less informative for unauthorized distillation (Ma et al. 2021, 2022). More recent work extends this output-centric view to generative models, especially large language models, where generated responses, reasoning traces, or reformulated outputs are adjusted to preserve user-facing utility while reducing their value as distillation data (Savani et al. 2025; Li et al. 2025b; Hartman et al. 2026; Ding et al. 2025; Fang et al. 2026). Our work brings this output-side anti-distillation perspective to text-to-image generative services, where released synthetic images remain perceptually useful to benign users while becoming less effective as supervision for unauthorized substitute models.
2.4
Frequency-Aware Perturbation Generation
Frequency-domain structure plays an important role in both adversarial robustness and perceptual quality. SimAC (Wang et al. 2024) and DDAP (Yang et al. 2024) highlight the value of frequency-aware perturbation design for diffusion-related attacks. From the generative side, wavelet-based architectures (Yang et al. 2022) show that low-frequency structure and high-frequency detail can be disentangled and reused through frequency-specific pathways. Frequency-aware adversarial generation (Zhu et al. 2023) further indicates that explicit frequency control can reduce visible artifacts. Beyond protection-oriented perturbations, controlled signal design has also been explored from a positive-utility perspective, where learned positive-incentive noise is used to benefit model training (Zhang et al. 2025, 2026; Zhu et al. 2026). These observations motivate our use of wavelet-based lowfrequency residuals and high-frequency skip injection to preserve layout while producing structured perturbations under a strict budget.
3 3.1
Threat Model and Problem Setup
Substitute Student Training Threat
We consider a teacher generative model T deployed in a closed-weight, query-exposed setting. Given a prompt p ∈ P, the teacher generates an image x \sim \mathcal {T}(p).
(1)
An attacker seeks to steal the capabilities of the teacher model by collecting its outputs for unauthorized knowledge distillation. The attacker collects a dataset of released generated outputs paired with prompts: \mathcal {D} = \{(p_i, x_i)\}_{i=1}^{N},
(2)
where each xi is a released image produced by the teacher for prompt pi , and N can be large because query-based collection is highly efficient. The attacker’s goal is to obtain a substitute student model S. Starting from a publicly available pretrained checkpoint, the attacker applies a standard personalization or fine-tuning method A to the collected dataset: \mathcal {S} = \mathcal {A}(\mathcal {D}). (3) The attack succeeds if S can generate images that match the teacher’s distribution and reproduce the teacher’s generation behavior. In this paper, we instantiate it as style knowledge distillation in substitute training, a concrete and measurable visual form of unauthorized distillation. The core task is therefore to prevent such style mimicry while preserving the utility of released images for benign users.
3.2
Defense Goals and Constraints
To protect the teacher outputs before release, we transform each clean image x into a protected image \tilde {x} = \Pi _{\mathrm {adv}}(x).
(4)
The attacker only observes x̃ rather than x. Our defense goals are threefold. Utility preservation: protected outputs should remain visually faithful to the
released content. Substitute-training disruption: students trained on protected outputs should replicate the teacher less effectively than students trained on clean outputs. Deployment practicality: protection should be efficient and explicitly budget-controlled enough for large-scale release scenarios. We also consider basic attacker-side preprocessing such as JPEG compression, blur, or purification.
4 4.1
Method
Overview
We propose WaveGuard, a generator-based, output-level protection framework against distillation. As illustrated in Figure 2(a), WaveGuard employs a frequency-aware perturbation generator Gθ (x, m) trained with a latent adversarial loss and a perturbation loss. Given a clean image x and a target image m, the generator predicts an additive perturbation that is applied to the original image to produce the protected output. At inference time, WaveGuard secures images in a single forward pass, ensuring high efficiency. We provide details on the generator architecture and optimization objectives in Sections 4.2 and 4.3, respectively.
4.2
Frequency-aware Perturbation Generator
We employ a U-Net-style encoder-decoder architecture, Gθ , to generate additive perturbations subject to an explicit magnitude constraint. For a given clean image x and target image m, we construct a joint input via channel-wise concatenation: x_{\mathrm {in}} = [x; m]. (5) The generator, comprising an encoder Enc(·) and a decoder Dec(·), maps the combined input to a perturbation δ = Gθ (xin ). To enhance the visual invisibility of the generated noise, we introduce Frequency Transform Blocks (FTBs). These blocks perform spectral decomposition on latent features, which are then integrated back into the main feature stream through the Frequency-aware Injection Path (FIP). Together, these modules facilitate frequency-aware perturbation generation, ensuring adversarial effectiveness while maintaining low visibility. Frequency Transform Blocks. Haar wavelet transform blocks (Daubechies 1990) are employed to decompose features into frequency components. The 1D Haar filters are defined as L^T=\frac {1}{\sqrt {2}}[1,\,1],\qquad H^T=\frac {1}{\sqrt {2}}[-1,\,1],
(6)
where L and H denote the low-pass and high-pass filters, respectively, and (·)T represents the transpose operator. Specifically, L extracts the local average of the signal, while H captures local differences. In 2D image processing, these filters are applied convolutionally along rows and columns to achieve multi-scale spectral decomposition, inducing four separable 2D analysis kernels. For an intermediate encoder feature map fi , the Frequency Transform Block applies the DWT using these kernels, yielding four subbands: (LL_i,\,LH_i,\,HL_i,\,HH_i)=\mathrm {DWT}(f_i).
(7)
Figure 2: Training pipeline and generator data flow. (a) Overview of the WaveGuard training pipeline. The generator predicts bounded adversarial perturbations and adds them to the original image to produce the protected output. (b) Data flow of low-frequency (LF) and high-frequency (HF) features in the frequency-aware injection path of the generator. (c) Grayscale visualization of the LL subband and high-frequency energy maps of the {LH, HL, HH} components. Here LLi captures low-frequency structures such as global layout and coarse shape, while {LHi , HLi , HHi } encode high-frequency details such as edges and contours. Figure 2(c) visualizes these components as a low-frequency grayscale map and high-frequency energy maps to characterize their distinct spectral properties. We apply these blocks at multiple scales to obtain multi-level frequency features across layers.
ing deep feature extraction, often leading to noisy adversarial examples with undesirable aliasing artifacts. To maintain visual fidelity, we explicitly route Hi to the decoder. During decoding, the cached component Hi is fused with the current decoder feature di+1 through the inverse DWT to reconstruct high-fidelity spectral details:
Frequency-aware Injection Path. Inspired by frequencyaware generative models (Yang et al. 2022), we leverage multi-level spectral features to enhance the generator’s frequency-domain understanding. As illustrated in Figure 2(b), WaveGuard strategically injects frequency components into both the encoder and decoder. On the encoder side, since LLi captures the global appearance and fundamental structural layout (Yang et al. 2022), we employ lowfrequency residual connections to preserve global semantics and ensure feature faithfulness during extraction. Specifically, let fi denote the encoder feature at scale i. After wavelet decomposition, we inject LLi into the subsequent encoding stage as a low-frequency residual to stabilize the feature flow:
Finally, d˜i is fused with the corresponding spatial skip features from the encoder to balance spectral integrity and spatial precision.
f_{i+1} = \mathrm {Enc}_{i+1}(f_i) + LL_i.
(8)
Here Enci+1 denotes the (i+1)-th layer of the encoder. Conversely, the high-frequency triplet Hi = {LHi , HLi , HHi } is cached as skip information to support fine-grained perturbation synthesis. Previous studies (Zhu et al. 2023) indicate that significant high-frequency information can be lost dur-
\tilde {d}_{i} = \mathrm {IDWT}(d_{i+1},\, H_i).
(9)
Bounded Perturbation Output. The generator outputs a normalized perturbation through a tanh layer and enforces a hard ℓ∞ bound via explicit scaling: \hat {\delta } &= \tanh (\mathrm {Dec}(\mathrm {Enc}(x_{\mathrm {in}}))), \\ \delta &= \epsilon \cdot \hat {\delta }, \\ \tilde {x} &= \Pi _{\mathrm {proj}}(x+\delta ), (12) where δ̂ is the normalized decoder output and δ is the final bounded perturbation. Here ϵ denotes the user-specified perturbation budget, while Πproj (·) projects the perturbed sample back to the valid image domain.
4.3
Training Loss
Latent Adversarial Loss with EOT. Following the targeted adversarial setting (Liang and Wu 2023; Zhu, Takahashi, and Kataoka 2024), we adopt a fixed black-and-white
target image m as the optimization target. The objective is to steer the latent representation of the protected image x̃ toward that of m, thereby obfuscating the original features extracted from x. Specifically, we utilize the frozen VAE encoder E(·) from Stable Diffusion as a surrogate latent encoder. Given a clean image x and the target image m, the encoder produces their respective latent embeddings E(x) and E(m). Under this targeted objective, we encourage the protected output to align with the target in the latent space by minimizing \mathcal {L}_{adv} = \mathbb {E}_{x\sim \mathcal {D}} \left [ \|E(\tilde {x})-E(m)\|_2^2 \right ].
(13)
This loss compels the generator to produce perturbations that mislead the generative model into capturing features of the target m while disrupting the encoding of the original image semantics. To enhance robustness against common post-processing operations, we further incorporate the Expectation over Transformations (EOT) framework. Specifically, we apply a set of random differentiable transformations t ∼ T to both x̃ and m during training: \mathcal {L}_{adv}^{\mathrm {EOT}} = \mathbb {E}_{x\sim \mathcal {D}}\, \mathbb {E}_{t\sim \mathrm {T}} \left [ \|E(t(\tilde {x}))-E(t(m))\|_2^2 \right ],
(14)
where T denotes a distribution of transformations including identity mapping, differentiable JPEG compression, and Gaussian blur. Weighted Perturbation Hinge Loss. To further reduce visual distortion induced by perturbations, we regularize perturbation magnitude using a weighted hinge penalty, as commonly adopted in adversarial training (Zhu et al. 2023; Zhu, Takahashi, and Kataoka 2024). Let δ = x̃ − x denote the additive perturbation. We construct a single-channel template mask m̄ from m and define a spatial weight map M = 1 + w\cdot \bar {m},
(15)
where w controls the strength of spatially non-uniform perturbation regularization. The weighted perturbation hinge loss is \mathcal {L}_{pert} = \mathbb {E}_{x\sim \mathcal {D}} \left [ \max \left (0,\ \|M\odot \delta \|_2 - c\right ) \right ],
(16)
where c controls the penalty threshold. Overall objective. θ by minimizing
We optimize the generator parameters
\min _{\theta }\ \lambda _{adv}\mathcal {L}_{adv}^{\mathrm {EOT}} +\lambda _{pert}\mathcal {L}_{pert}.
(17)
Only Gθ is updated during training, while the target VAE encoder remains frozen.
5 5.1
Experiments
Experimental Setup
We evaluate WaveGuard under a synthetic-output distillation scenario, where an attacker collects released images from a text-to-image teacher and uses them to train an unauthorized student model. This setting allows us to measure released-image fidelity, substitute-training disruption, and deployment efficiency in a unified evaluation pipeline.
Datasets. We use WikiArt (Saleh and Elgammal 2016) (over 80,000 artworks; 129 artists, 11 genres, and 27 styles) as the default artistic-style domain. We select 28 representative artists and use 4–6 artworks per artist to build personalized teacher models. For generator training, we sample about 500 additional real artworks from the same artist pool, disjoint from the personalization set. We also build an alternative synthetic training set by generating roughly 18 teacher outputs per artist. Unless otherwise specified, the generator is trained on the real-image set, and the artist split is kept fixed across all experiments. Teacher and student models. Our default teacher is a personalized Stable Diffusion v1.5 (SD1.5) model. The substitute student can be initialized from public open-source latent-diffusion checkpoints, including SD1.5 and SD2.1. Unless otherwise specified, we use SD1.5 for the main student initialization, while the SD2.1 student is discussed in Section 5.6. We evaluate unauthorized student training with two fine-tuning methods: DreamBooth and Textual Inversion. Baselines. We compare WaveGuard with two iterative baselines, Mist (Liang and Wu 2023) and CosAttack (Li et al. 2025a), and one generative baseline, AdvWM (Zhu, Takahashi, and Kataoka 2024). Unless stated otherwise, all methods are evaluated at ϵ = 8/255 under the same ℓ∞ constraint. Attack protocol. Since style mimicry is a concrete manifestation of unauthorized knowledge distillation, we focus on this threat model in our evaluation. The teacher first generates synthetic outputs, which are then protected before release; the attacker collects these protected outputs and trains a substitute model. Concretely, we use a prompt family of 10 variants such as ‘‘a drawing in the style of sks’’ to synthesize teacher outputs for each artist, and the attacker uses those outputs for substitute training. Metrics. For fidelity, we report PSNR, SSIM, and LPIPS between clean images x and protected images x̃; higher PSNR/SSIM and lower LPIPS indicate better visual fidelity. For protection effectiveness, we evaluate style replication between teacher and student outputs using ArtFID (Wright and Ommer 2022) and CSD (Somepalli et al. 2024). Lower CSD and higher ArtFID indicate stronger protection, since they reflect weaker style reproduction by the student. Implementation details. All images are generated and evaluated at 512 × 512. WaveGuard trains the perturbation generator for 200 epochs with batch size 8 and Adam optimization, while the target Stable Diffusion v1.5 VAE encoder is frozen. DreamBooth students use a unified finetuning setup, and Textual Inversion students follow a consistent 500-step protocol. The same hardware and framework configuration was used across methods for fair runtime and robustness comparisons.
5.2
Quantitative Results
Table 1 reports the main results at ϵ = 8/255 on this representative visual instantiation, including both DreamBooth
PSNR vs CSD Trade-off Plot
0.9
WaveGuard Mist AdvWM CosAttack
0.8
CSD
0.7
=16
0.6
=8 =4
=12
=8
0.5 0.4
=4 =4
=8 =12
=12
0.3 28
30
32
34
PSNR
36
38
40
Figure 3: Budget-controlled fidelity–protection trade-off. Each point corresponds to a different perturbation budget.
and Textual Inversion (TI) students. The key pattern is consistent across metrics: WaveGuard achieves the best visual fidelity among the compared defenses while still providing substantial protection over the no-protection baseline. In particular, Mist obtains the strongest protection on the DreamBooth CSD and ArtFID metrics, whereas WaveGuard attains the best PSNR, SSIM, and LPIPS. For the TI student, WaveGuard remains clearly better than the clean baseline and competitive with CosAttack, although AdvWM and Mist are stronger in this setting. WaveGuard represents a different operating point from maximum-disruption iterative baselines: it prioritizes high-fidelity released outputs and single-pass deployability while maintaining effective protection against substitute training.
5.3
Efficiency and Perturbation-Budget Trade-off
Table 2 summarizes runtime, and Figure 3 shows the PSNR–CSD trade-off under varying perturbation budgets. Generator-based methods are substantially faster than iterative optimization baselines. In particular, WaveGuard and AdvWM operate at similar speed, while WaveGuard attains a more favorable PSNR–CSD trajectory than the iterative baseline CosAttack in the evaluated range. At comparable or better fidelity, WaveGuard provides non-trivial protection gains over no protection and approaches the protection strength of iterative baselines with orders-of-magnitude lower runtime.
5.4
Figure 4: Qualitative comparison of DreamBooth student outputs after protection. Poorer style replication indicates stronger protection. WaveGuard reduces style replication while keeping the released protected images visually closer to the clean images than iterative baselines.
Qualitative Analysis
Figure 4 evaluates downstream imitation by comparing DreamBooth student outputs trained on images protected by different methods. Figure 5 analyzes the released protected images themselves, including their visual appearance and perturbation spectra. Iterative methods, especially CosAttack, spread perturbation energy more broadly and introduce stronger spatial artifacts. By contrast, WaveGuard produces more structured perturbations with weaker visible distortion, consistent with its role as a high-fidelity defense point rather than a maximum-disruption method.
Figure 5: Visual and frequency-domain analysis of protected images. Compared with iterative baselines, WaveGuard shows weaker overall perturbation energy and less visually disruptive frequency spread, which is consistent with its stronger fidelity metrics.
5.5
Ablation Study
We further analyze the design of our frequency module in Table 3. The full model achieves the best PSNR, SSIM, CSD, and ArtFID among these variants. Removing LF injection slightly reduces fidelity and weakens protection, suggesting that low-frequency feature routing contributes to the overall trade-off. Removing HF injection leaves fidelity nearly unchanged but weakens protection more noticeably, indicating that high-frequency skip routing helps produce perturbations that remain effective for disrupting substitute training. Beyond the frequency-aware architecture, we further study two design choices in the supplementary material: the target image used in the latent objective and the data source used to train the perturbation generator.
Table 1: Main results on synthetic-output protection. DreamBooth and Textual Inversion (TI) results are reported jointly. WaveGuard achieves the strongest fidelity metrics while maintaining effective protection under both student training routes. Best and second-best values are marked in bold and underlined, respectively. Method No protection Mist (Liang and Wu 2023) CosAttack (Li et al. 2025a) AdvWM (Zhu, Takahashi, and Kataoka 2024) WaveGuard (ours)
Fidelity PSNR↑ SSIM↑ LPIPS↓ N/A N/A N/A 33.079 0.878 0.144 30.545 0.831 0.208 34.555 0.896 0.102 36.201 0.930 0.089
Table 2: Runtime comparison. Generator-based methods protect images substantially faster than iterative optimization baselines. Raw Batch Latency Method latency (s) size (s/image) Mist 20.41 1 20.410 CosAttack 17.72 1 17.720 AdvWM 0.11 4 0.030 WaveGuard 0.10 4 0.025
Table 3: Module-wise differential ablation under the same training protocol. The full WaveGuard model provides the strongest overall fidelity–protection balance. Method PSNR↑ SSIM↑ LPIPS↓ CSD↓ ArtFID↑ WaveGuard (full) 36.201 0.930 0.089 0.640 24.920 w/o LF 35.806 0.925 0.089 0.694 24.165 w/o HF 36.193 0.929 0.088 0.704 23.048 w/o Wave module 35.996 0.927 0.089 0.706 23.460
Table 4: Transfer to another latent-diffusion checkpoint (SD2.1). Training data CSD↓ ArtFID↑ No protection 0.845 20.311 25.657 WaveGuard (ϵ = 8/255) 0.663 WaveGuard (ϵ = 12/255) 0.582 27.648
5.6
Robustness to Attacker Strategies
We next evaluate practical attacker-side strategies that may weaken protection before substitute training. Transfer to another latent-diffusion checkpoint. Table 4 evaluates a student initialized from Stable Diffusion v2.1. Although WaveGuard is trained with a Stable Diffusion v1.5 VAE surrogate, it still degrades style replication for the SD2.1 student, indicating cross-checkpoint transferability. Mixed clean/protected training. We also evaluate mixeddata training, where attackers combine clean and protected samples under a fixed budget of 10 samples per artist. Table 5 reports the results. Increasing the fraction of protected data consistently improves disruption. A 50% protected ratio nearly matches the all-protected setting in CSD, although a gap remains in ArtFID. Preprocessing robustness. We evaluate JPEG compression, Gaussian blur, and DiffPure (Nie et al. 2022) as
DreamBooth Protection CSD↓ ArtFID↑ 0.830 17.750 0.460 30.338 0.539 24.455 0.628 23.673 0.640 24.920
TI Protection CSD↓ ArtFID↑ 0.792 22.805 0.440 31.749 0.504 29.064 0.439 32.495 0.500 30.624
Table 5: Mixed clean/protected training. # clean / 10 10 (all clean) 8 5 0 (all protected)
CSD↓ 0.844 0.816 0.664 0.663
ArtFID↑ 18.716 19.621 24.255 26.687
Table 6: Preprocessing robustness of WaveGuard. Preprocessing No protection WaveGuard (clean) + JPEG + Blur + DiffPure
CSD↓ 0.859 0.613 0.760 0.688 0.825
ArtFID↑ 16.951 27.790 20.816 23.314 19.327
attacker-side preprocessing. As shown in Table 6, all three preprocessing operations weaken protection. WaveGuard remains clearly stronger than no protection under JPEG and blur, whereas DiffPure reduces the protection effect much more substantially and brings the metrics closer to the noprotection baseline.
6
Conclusion
We studied the problem of safeguarding generative models against unauthorized knowledge distillation through output-level adversarial protection. We presented WaveGuard, a frequency-aware, single-pass perturbation generator that protects images released by text-to-image generative services. Rather than pursuing maximum disruption alone, WaveGuard targets a high-fidelity deployment regime: it enforces an explicit perturbation budget, preserves visual quality, and provides efficient protection at release time. In the studied WikiArt-style distillation scenario, WaveGuard achieves the best fidelity among compared defenses while retaining meaningful protection and strong runtime advantages. Further analyses characterize transferability and vulnerabilities under alternative students, models, targets, training mixes, and preprocessing. We also find that strong purification such as DiffPure can substantially weaken the protection. Future work will extend the evaluation to broader domains and improve robustness against stronger adaptive preprocessing. Overall, these results suggest that output-level, generator-based protection is a promising direction for safeguarding generative models against unauthorized knowledge distillation.
References Chung, J.; Hyun, S.; and Heo, J.-P. 2024. Style Injection in Diffusion: A Training-Free Approach for Adapting LargeScale Diffusion Models for Style Transfer. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 8795–8805. Cui, Y.; Ren, J.; Xu, H.; He, P.; Liu, H.; Sun, L.; Xing, Y.; and Tang, J. 2025. DiffusionShield: A Watermark for Data Copyright Protection against Generative Diffusion Models. ACM SIGKDD Explorations Newsletter, 26(2): 60–75. Daubechies, I. 1990. The wavelet transform, time-frequency localization and signal analysis. IEEE Transactions on Information Theory, 36(5): 961–1005. Dhariwal, P.; and Nichol, A. 2021. Diffusion Models Beat GANs on Image Synthesis. In Advances in Neural Information Processing Systems, 8780–8794. Ding, J.; Cui, L.; Dong, L.; Zheng, N.; and Wei, F. 2025. Information-Preserving Reformulation of Reasoning Traces for Antidistillation. arXiv:2510.11545. Fang, H.; Zhang, T.; Zhuang, T.; Kong, J.; Gao, K.; Chen, B.; Zheng, L.; Xia, S.-T.; and Xu, K. 2026. Towards Distillation-Resistant Large Language Models: An Information-Theoretic Perspective. arXiv:2602.03396. Gal, R.; Alaluf, Y.; Atzmon, Y.; Patashnik, O.; Bermano, A. H.; Chechik, G.; and Cohen-Or, D. 2022. An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversion. In International Conference on Learning Representations. Gu, Z.; Xu, Y.; Huang, S.; Guo, Y.; and Zhang, H. 2026. Rectified Noise: A Generative Model Using Positiveincentive Noise. Proceedings of the AAAI Conference on Artificial Intelligence, 40(6): 4357–4365. Hartman, M.; Jayaraman, V.; Choraria, M.; Savani, Y.; and Varshney, L. R. 2026. Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models. arXiv:2604.23238. Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33: 6840–6851. Hu, B.; Wei, Y.; Xiao, J.; Huang, W.; Bi, X.; and Xiao, B. 2025. Who Controls the Authorization? Invertible Networks for Copyright Protection in Text-to-Image Synthesis. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 15832–15841. Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; and Chen, W. 2022. LoRA: Low-Rank Adaptation of Large Language Models. In International Conference on Learning Representations. Huang, S.; Huang, S.; Luo, P.; and Zhang, H. 2026. Laytrol: Preserving Pretrained Knowledge in Layout Control for Multimodal Diffusion Transformers. Proceedings of the AAAI Conference on Artificial Intelligence, 40(7): 5113– 5121. Huang, Z.; Qiu, X.; Ma, Y.; Zhou, Y.; Chen, J.; Zhang, H.; Zhang, C.; and Li, X. 2025. NFIG: Multi-Scale Autoregressive Image Generation via Frequency Ordering.
Kumari, N.; Zhang, B.; Zhang, R.; Shechtman, E.; and Zhu, J.-Y. 2023. Multi-Concept Customization of Text-to-Image Diffusion. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 1931–1941. Le, T. V.; Phung, H.; Nguyen, T. H.; Dao, Q.; Tran, N.; and Tran, A. 2023. Anti-DreamBooth: Protecting users from personalized text-to-image synthesis. Li, M.; Wang, R.; Sun, M.; and Jing, L. 2025a. Preventing Latent Diffusion Model-Based Image Mimicry via Angle Shifting and Ensemble Learning. In International Joint Conference on Artificial Intelligence, 1395–1403. Li, P.; Tan, Z.; Zhang, M.; Qu, H.; Liu, H.; and Chen, T. 2025b. DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation. Liang, C.; and Wu, X. 2023. Mist: Towards Improved Adversarial Examples for Diffusion Models. Liang, C.; Wu, X.; Hua, Y.; Zhang, J.; Xue, Y.; Song, T.; Xue, Z.; Ma, R.; and Guan, H. 2023. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. Liu, Y.; Fan, C.; Dai, Y.; Chen, X.; Zhou, P.; and Sun, L. 2023. MetaCloak: Preventing Unauthorized Subject-driven Text-to-image Diffusion-based Synthesis via Meta-learning. Ma, H.; Chen, T.; Hu, T.-K.; You, C.; Xie, X.; and Wang, Z. 2021. Undistillable: Making A Nasty Teacher That Cannot Teach Students. In International Conference on Learning Representations (ICLR). Ma, H.; Huang, Y.; Tang, H.; You, C.; Kong, D.; and Xie, X. 2022. Sparse logits suffice to fail knowledge distillation. In International Conference on Learning Representations (ICLR). Mou, C.; Wang, X.; Xie, L.; Wu, Y.; Zhang, J.; Qi, Z.; and Shan, Y. 2024. T2I-Adapter: Learning Adapters to Dig Out More Controllable Ability for Text-to-Image Diffusion Models. AAAI Conference on Artificial Intelligence, 38(5): 4296–4304. Nie, W.; Guo, B.; Huang, Y.; Xiao, C.; Vahdat, A.; and Anandkumar, A. 2022. Diffusion Models for Adversarial Purification. Park, J.; Ko, B.; and Jang, H. 2023. StyleBoost: A Study of Personalizing Text-to-Image Generation in Any Style using DreamBooth. In International Conference on Information and Communication Technology Convergence (ICTC), 93– 98. Podell, D.; English, Z.; Lacey, K.; Blattmann, A.; Dockhorn, T.; Müller, J.; Penna, J.; and Rombach, R. 2024. SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis. In International Conference on Learning Representations. Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-Resolution Image Synthesis with Latent Diffusion Models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 10674–10685. Ruiz, N.; Li, Y.; Jampani, V.; Pritch, Y.; Rubinstein, M.; and Aberman, K. 2023. DreamBooth: Fine Tuning Textto-Image Diffusion Models for Subject-Driven Generation.
In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 22500–22510. Saleh, B.; and Elgammal, A. 2016. Large-Scale Classification of Fine-Art Paintings: Learning the Right Metric on the Right Feature. International Journal for Digital Art History, (2): 71–94. Salman, H.; Khaddaj, A.; Leclerc, G.; Ilyas, A.; and Madry, A. 2023. Raising the Cost of Malicious AI-Powered Image Editing. Savani, Y.; Trockman, A.; Feng, Z.; Xu, Y. E.; Schwarzschild, A.; Robey, A.; Finzi, M. A.; and Kolter, J. Z. 2025. Antidistillation Sampling. In Advances in Neural Information Processing Systems. Shan, S.; Cryan, J.; Wenger, E.; Zheng, H.; Hanocka, R.; and Zhao, B. Y. 2023a. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. Shan, S.; Ding, W.; Passananti, J.; Wu, S.; Zheng, H.; and Zhao, B. Y. 2023b. Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models. Somepalli, G.; Gupta, A.; Gupta, K.; Palta, S.; Goldblum, M.; Geiping, J.; Shrivastava, A.; and Goldstein, T. 2024. Measuring Style Similarity in Diffusion Models. Song, J.; Meng, C.; and Ermon, S. 2021. Denoising Diffusion Implicit Models. In International Conference on Learning Representations. Wang, F.; Tan, Z.; Wei, T.; Wu, Y.; and Huang, Q. 2024. SimAC: A Simple Anti-Customization Method for Protecting Face Privacy against Text-to-Image Synthesis of Diffusion Models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12047–12056. Wright, M.; and Ommer, B. 2022. ArtFID: Quantitative Evaluation of Neural Style Transfer. In Pattern Recognition: 44th DAGM German Conference, GCPR 2022, 560–576. Yang, J.; Xi, R.; Lai, Y.; Lin, X.; and Yu, Z. 2024. DDAP: Dual-Domain Anti-Personalization against Text-to-Image Diffusion Models. Yang, M.; Wang, Z.; Chi, Z.; and Feng, W. 2022. WaveGAN: Frequency-aware GAN for High-Fidelity Few-shot Image Generation. Ye, X.; Huang, H.; An, J.; and Wang, Y. 2024. DUAW: DataFree Universal Adversarial Watermark against Stable Diffusion Customization. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models. Zhang, H.; Huang, S.; Guo, Y.; and Li, X. 2025. Variational Positive-Incentive Noise: How Noise Benefits Models. IEEE Transactions on Pattern Analysis and Machine Intelligence, 47(9): 8313–8320. Zhang, H.; Xu, Y.; Huang, S.; and Li, X. 2026. Data Augmentation of Contrastive Learning is Estimating Positiveincentive Noise. In International Conference on Machine Learning. Zhang, L.; Rao, A.; and Agrawala, M. 2023. Adding Conditional Control to Text-to-Image Diffusion Models. In IEEE/CVF International Conference on Computer Vision, 3813–3824.
Zhao, Y.; Pang, T.; Du, C.; Yang, X.; Cheung, N.-M.; and Lin, M. 2023. A Recipe for Watermarking Diffusion Models. Zhu, P.; Osada, G.; Kataoka, H.; and Takahashi, T. 2023. Frequency-aware GAN for Adversarial Manipulation Generation. In IEEE/CVF International Conference on Computer Vision, 4292–4301. Zhu, P.; Takahashi, T.; and Kataoka, H. 2024. Watermarkembedded Adversarial Examples for Copyright Protection against Diffusion Models. Zhu, R.; Huang, S.; Jiao, Z.; and Zhang, H. 2026. Explore How to Inject Beneficial Noise in MLLMs. Proceedings of the AAAI Conference on Artificial Intelligence, 40(34): 29150–29158. Zhu, R.; Huang, Z.; Sun, J.; Luo, P.; Zhang, H.; and Li, X. 2025. ViewMask-1-to-3: Multi-View Consistent Image Generation via Multimodal Diffusion Models. arXiv:2512.14099.
A A.1
Experimental Information
Hardware and Software Environment
We use two execution environments, one for student finetuning/evaluation and one for WaveGuard generator training, as summarized in Table 7. Table 7: Hardware and framework versions used in experiments. Item Configuration Student Train/Eval RTX 4080 SUPER WaveGuard Train RTX 4090 D PyTorch 2.3.1+cu121 diffusers 0.29.2 accelerate 1.12.0
A.2
Dataset Splits
Our default training and evaluation set includes the following 28 artists (the 8 artists used for supplementary sampling are highlighted in yellow): alberto-magnelli, amedeo-modigliani, andrei-ryabushkin, caspar-david-friedrich , claude-monet , edvard-munch, el-greco, giuseppe-arcimboldo , gustav-klimt, gustave-dore , henri-rousseau, jackson-pollock, jean-francois-millet, lucian-freud, lyubov-popova , marcel-duchamp, maria-helena-vieira-da-silva, mark-rothko, max-beckmann, mikhail-nesterov , mikhail-vrubel , odilon-redon, oswaldo-guayasamin, pablo-picasso, paul-gauguin , paul-signac, tivadar-kosztka-csontvary, willem-de-kooning
A.3
Training Details
Generator Training Details The implementation of WaveGuard uses a frozen Stable Diffusion v1.5 VAE encoder as a feature-space target and trains only the perturbation generator. Unless otherwise specified, training uses 200 epochs, batch size 8, Adam optimizer with learning rate 1 × 10−3 , and random seed 42. All images are resized to 512 × 512 with center crop. The perturbation budget is set to ϵ = 8/255 in [0, 1] space (equivalently 2 × 8/255 in [−1, 1] space). During training, we apply expectation-overtransformation (EOT) augmentations: differentiable JPEG simulation with quality sampled from [30, 95] and Gaussian blur with σ ∼ U (0.1, 1.5), each applied independently with probability 0.5. For JPEG/blur robustness evaluation, we apply JPEG compression with quality factor 50 and Gaussian blur with kernel size 5 to the generated protected images.
Teacher/Student Training Details Our teacher-side personalization is based on DreamBooth fine-tuning with Stable Diffusion v1.5. On the student side, we evaluate two training routes, DreamBooth and Textual Inversion, initialized from Stable Diffusion v1.5 or v2.1. We next describe the parameter settings for each route. DreamBooth Settings. All DreamBooth student finetuning experiments follow a unified protocol. We train DreamBooth at resolution 512 × 512 with batch size 1, gradient accumulation steps 1, and 400 optimization steps. Optimization uses 8-bit Adam with a constant learning rate of 5 × 10−6 , with no warmup steps. For each artist folder in the protected training set, we train one personalized DreamBooth student using the instance prompt “a painting in sks style”. Prior preservation is enabled with the class prompt “a painting in art style”, with the number of class images set to 100, and a prior loss weight of 1.0. Textual Inversion Settings. For Textual Inversion (TI) evaluation, we train one TI embedding per artist using each method’s corresponding protected training set, while keeping the TI hyperparameters identical across methods. TI training uses the initializer token “art”, resolution 512, batch size 1, gradient accumulation steps 4, learning rate 5 × 10−4 (constant schedule, no warmup), and 500 optimization steps. We assign a unique placeholder token to each artist and evaluate the checkpoint at step 500.
A.4
Prompt Set
For DreamBooth, we use the token “sks”. For Textual Inversion, we use a learned placeholder token such as “ti vango”. "a painting in sks style", "a painting in the style of sks", "an artwork in sks style", "an artwork in the style of sks", "a picture in sks style", "a picture in the style of sks", "a drawing in sks style", "a drawing in the style of sks", "a masterpiece in sks style", "a masterpiece in the style of sks"
B B.1
Architecture and Implementation
WaveGuard Architecture
WaveGuard uses a U-Net-style generator with waveletbased skip connections. Given a clean image x ∈ [0, 1]3×H×W and a watermark target m ∈ [0, 1]C×H×W , we map m to three channels when C = 1 and concatenate it with x: x̂ = concat(x, m) ∈ R6×H×W . The main encoder branch is downsampled by stride-2 convolutions, while fixed Haar wavelet decomposition provides LL features for encoder fusion and HF features for decoder skip injection. Starting from a bottleneck feature at H/16 × W/16, the decoder reconstructs a full-resolution perturbation map through wavelet unpooling, projection, and refinement. The output is a normalized perturbation map ∆norm ∈ [−1, 1]3×H×W , which is scaled by the perturbation budget ϵ. Table 8 summarizes the layer-by-layer architecture. In the table, WP/WP2 denote two wavelet pooling variants, WUP
Table 8: WaveGuard Architecture. Stage Input Enc-1 Enc-2 Enc-3 Enc-4 Bottleneck Dec-4 Dec-3 Dec-2 Dec-1 Out
Op concat(x, m) Conv5,s1 + WP Conv3,s2 + WP Conv3,s2 + WP2 Conv3,s2 + WP2 Conv3,s2 WUP + skip + ref WUP + skip + ref WUP + proj + ref WUP + proj + ref Conv5,s1 + Tanh
Channels 3+3 → 6 6 → 32 32 → 64 64 → 128 128 → 128 128 → 128 128 → 128 128 → 128 128 → 64 64 → 32 32 → 3
Scale H×W H →H H → H/2 H/2 → H/4 H/4 → H/8 H/8 → H/16 H/16 → H/8 H/8 → H/4 H/4 → H/2 H/2 → H H
Wavelet concat fusion keep HF1 keep HF2 +LL1 , keep HF3 +LL2 , keep HF4 +LL3 inject HF4 inject HF3 inject HF2 inject HF1 ∆norm ∈ [−1, 1]
Table 9: Real-image protection results. WaveGuard achieves the best imperceptibility and the highest ArtFID, while maintaining competitive CSD. Imperceptibility Protection Method PSNR↑ SSIM↑ LPIPS↓ CSD↓ ArtFID↑ No protection N/A N/A N/A 0.743 26.546 Mist (Liang and Wu 2023) 33.077 0.878 0.144 0.450 31.631 CosAttack (Li et al. 2025a) 30.191 0.819 0.227 0.418 30.051 AdvWM (Zhu, Takahashi, and Kataoka 2024) 34.232 0.888 0.118 0.485 31.648 WaveGuard (ours) 36.593 0.931 0.088 0.510 32.879
Table 10: Quantitative comparison under different target images. The target design controls an additional trade-off between image fidelity and protection strength. Target PSNR↑ SSIM↑ LPIPS↓ CSD↓ ArtFID↑ Watermark image 36.201 0.930 0.089 0.640 24.920 Mist-style image 35.451 0.921 0.091 0.590 25.068
Figure 6: Qualitative illustration of student training. A student initialized from a public checkpoint can be finetuned on teacher outputs to imitate the teacher’s style. denotes wavelet unpooling, HFk /LLk denote the high-/lowfrequency branches at stage k, and “skip”, “proj”, and “ref” denote skip fusion, channel projection, and feature refinement, respectively. The perturbation is computed as ∆ = ϵ · ∆norm , and the final protected image is xadv = clip(x + ∆, 0, 1). Unless otherwise specified, we use ϵ = 8/255.
C
Additional Experimental Results and Analyses
Figure 7: Effect of different target-image designs. The top row uses a Mist-style target image, and the bottom row uses the default watermark target image.
best imperceptibility metrics and the highest ArtFID, while maintaining competitive CSD, suggesting that the proposed generator also provides a favorable fidelity–protection tradeoff beyond synthetic outputs.
C.3
Target and Training Source Analyses
We include a qualitative illustration of substitute training, a real-image protection comparison for consistency with prior evaluation settings, additional target/source design analyses, and an EOT ablation for attacker-side preprocessing.
Beyond the frequency-aware architecture, we analyze two design choices that may affect the learned protection behavior: the target image used in the latent objective and the data source used to train the perturbation generator.
C.1
Target-image design. Table 10 and Figure 7 compare the default binary target (Hu et al. 2025) with a higher-contrast Mist-style target (Liang and Wu 2023). The Mist-style target produces somewhat stronger protection, while the binary target provides better fidelity. This comparison supports the view that target design itself controls an additional fidelity– protection trade-off. This result also indicates that the target image should be treated as a tunable design choice rather than a fixed universal optimum.
Qualitative Illustration of Substitute Training
Figure 6 illustrates the substitute-training threat considered in this work. A student initialized from a public checkpoint can be fine-tuned on teacher-generated outputs to mimic the teacher’s style.
C.2
Real-image Protection Task
Although our main experiments focus on protecting synthetic images released by a generative service, we also evaluate WaveGuard under a real-image protection setting to facilitate comparison with prior work. In this setting, real WikiArt images are perturbed before release, and the attacker trains a downstream student model on the perturbed images. Table 9 reports the results. WaveGuard achieves the
Generator training source. For training the protection generator, we compare two data sources in the syntheticoutput protection setting: Greal , trained on real WikiArt images, and Gsyn , trained on teacher-generated outputs. As shown in Table 11, training on real WikiArt images achieves
Table 11: Training source comparison in synthetic-output protection. Positive ∆syn-better indicates that training on teacher-generated synthetic outputs outperforms training on real images. Source Greal Gsyn ∆syn-better
PSNR↑ 36.201 35.974 -0.227
SSIM↑ 0.930 0.927 -0.003
LPIPS↓ 0.089 0.086 +0.003
CSD↓ 0.640 0.727 -0.087
ArtFID↑ 24.920 23.474 -1.446
Table 12: Impact of EOT on preprocessing. Lower ∆CSD and lower ∆ArtF ID indicate smaller degradation after preprocessing. EOT w/ w/o w/ w/o
Attack Blur Blur JPEG JPEG
∆CSD ↓ 0.075 0.161 0.147 0.149
∆ArtF ID ↓ 4.476 4.934 6.974 6.881
better overall protection, especially on CSD and ArtFID, while the synthetic source only slightly improves LPIPS.
C.4
EOT Analysis under Preprocessing Attacks
The main paper reports preprocessing robustness under JPEG compression, Gaussian blur, and DiffPure. Here, we further isolate the effect of EOT during WaveGuard training. Table 12 reports the metric degradation after preprocessing. EOT improves robustness to blur and provides a small CSD improvement under JPEG. Its effect on JPEG ArtFID is negligible, indicating that EOT helps most when the preprocessing operation matches the differentiable augmentations used during generator training.