BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing

We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.

---

Q1. Further analysis on per-region adaptation

Thank you for your thoughtful suggestion. We agree that a further analysis of the per-region adaptation module would enhance clarity. For your information, our extended ablation study in Appendix G provides a qualitative comparison between BlurGuard and the vanilla PhotoGuard, showing how BlurGuard adaptively allocates noise frequencies and produces perceptually natural perturbations. In the final draft, we will incorporate additional qualitative examples (e.g., more BlurGuard perturbations across different region types) and quantitative results (e.g., correlation between the learned $\sigma$ values and semantic regions, as you suggested) to further improve clarity of the module.

---

Q2. Inpainting under mask variability

As you mentioned, our inpainting experiments primarily focus on “region-targeted” protection, where adversarial perturbations are selectively applied to the region intended for editing. We emphasize that this setup is practically motivated, as it reflects realistic misuse scenarios where a sensitive region, e.g., a person’s face, is kept intact while the surrounding areas are manipulated.

That said, we agree that real-world inpainting scenarios may involve unpredictable and diverse masking patterns. Indeed, this challenge has recently attracted attention in the literature; for example, DiffusionGuard [1], which we also include as a baseline, proposes the InpaintGuardBench dataset to benchmark robustness of image protection methods under mask variability.

To further address your concern, we conducted additional experiments on InpaintGuardBench, evaluating BlurGuard across six different masks per image, including both “seen” (used for protection) and “unseen” (novel at test time) masks. As shown in the table below, BlurGuard maintains strong protection performance across these mask variations, suggesting that BlurGuard not only provides robustness on the region-targeted setup but also generalizes well to more diverse inpainting scenarios. We will incorporate this discussion and the additional results into the final draft.

---

Q3. ImageNet-Edit: Additional details needed

Thank you for the suggestion. We agree that providing additional clarification on the ImageNet-Edit dataset we constructed would enhance the reproducibility of our work. For your information, we note that we have included the full dataset as part of our supplementary material submission, along with the complete set of prompts used. We also plan to publicly release the dataset upon acceptance to further support reproducibility.

---

[1] Choi et al., DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR 2025.

---

We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.

---

Q1. BlurGuard with MMDiT-based models

Thank you for the suggestion. We agree that including evaluations on more recent models, e.g., the MMDiT-based architectures with flow-matching you mentioned, would further strengthen our work. Following your suggestion, we have extended our experiments to two additional models, viz., SD-v3.5 [1] and FLUX.1-dev [2], as shown in the following two tables. Overall, the results confirm again that BlurGuard offers the most effective protection against worst-case purification attempts, while also demonstrating the high adaptability of our framework. We will incorporate these additional results into the final draft, and continue to extend our evaluation to other models, e.g., Step1X-Edit [3] you also mentioned.

Table 1: Comparison of image protection on ImageNet-Edit, tested on SD-v3.5 [1].

Table 2: Comparison of image protection on ImageNet-Edit, tested on FLUX.1-dev [2].

---

Q2. Additional related work

Thank you for suggesting additional related works. For your information, we note that Appendix A.1 already includes a brief discussion on watermarking-based approaches, including the VINE work [4] you referred to. Nevertheless, we agree that providing a dedicated discussion on frequency-based methods explored in other lines of work, e.g., Robust-Wide [5] you mentioned, would help better contextualize our contributions. We will revise our manuscript to include an additional discussion of these related works in the main text of the final draft.

---

Q3. Transferability analysis to different architectures, e.g., MMDiT?

Following your suggestion, we have additionally conducted black-box transfer experiments from SD-v1.4 to SD-v3.5 and FLUX.1-dev; both of which are based on MMDiT with flow-matching training, i.e., significantly diverging from SD-v1.4 in both architecture and training scheme. From the results summarized in the table below, we observe two key points: (a) BlurGuard consistently improves performance over the vanilla PhotoGuard across all metrics, showing the clear effectiveness of BlurGuard to enhance transferability; and (b) BlurGuard remains either the most effective or competitive across the board, further supporting general applicability of our approach. These observations confirm that our proposed framework offers a promising direction for improving the transferability of adversarial image protection methods. We will incorporate these additional results and the respective discussion in the final draft.

---

[1] stabilityai/stable-diffusion-3.5-medium
[2] black-forest-labs/FLUX.1-dev
[3] Liu et al., Step1X-Edit: A Practical Framework for General Image Editing, 2025.
[4] Lu et al., Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances, ICLR 2025.
[5] Hu et al., Robust-Wide: Robust Watermarking against Instruction-driven Image Editing, ECCV 2024.

---

Dear Reviewer jjT1,

Thank you very much for your prompt response and encouraging words!

We truly value your thoughtful consideration, and we would be happy to address any further clarification you may need as the discussion continues.

Best regards,
Authors

We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.

---

Q1. BlurGuard with other adversarial objectives

As you mentioned, BlurGuard is compatible with a variety of adversarial image protection objectives beyond the encoder attack primarily considered in our experiments. Following your suggestion, we have additionally tested BlurGuard in combination with other adversarial objectives, viz., AdvDM [1] and Mist [2]. Specifically, AdvDM aims to directly maximize the denoising loss of the diffusion process, and Mist considers a combined form of encoder and denoising attacks. As shown in the table below, we observe that BlurGuard preserves its effectiveness in improving both naturalness and worst-case effectiveness of both attacks, confirming the broad applicability of our framework across diverse protection objectives. We will incorporate these additional results in the final draft.

---

Q2. Additional ablation study

We appreciate your insightful suggestions regarding further ablation studies. In response, we have conducted additional experiments based on the following two ablations of BlurGuard: (a) applying blurring directly to the protected image (i.e., $\mathbf{x} + \boldsymbol{\delta}$) rather than only to the perturbation (i.e., $\boldsymbol{\delta}$), and (b) replacing the blurring operation with sharpening, which effectively acts as a high-pass filter. From the results shown in the table below, we observe the following:

• (a) Blurring $\mathbf{x} + \boldsymbol{\delta}$ has a moderate effect in enhancing robustness, e.g., over the vanilla PhotoGuard. However, it also results in a notable drop in naturalness metrics compared to BlurGuard, as blurring the entire image erases high-frequency details from the image itself and thus compromises perceptual quality. In contrast, BlurGuard can avoid the issue by applying blur only to $\boldsymbol{\delta}$, preserving both robustness and visual fidelity.
• (b) The adaptive sharpening scheme, implemented via unsharp masking [3], did not provide effective protection after purification. This is because sharpening rather amplifies high-frequency patterns, which can be easily suppressed by known purification techniques, e.g., JPEG compression.

Overall, these results highlight our proposed adaptive blurring scheme as a more effective strategy, achieving both robustness and perceptual naturalness. We will incorporate these results in our final manuscript.

---

Q3. Editorial comments

Thank you very much for your detailed reading. We agree that your editorial suggestions will help strengthen the clarity of our manuscript. We will thoroughly review all of your comments and incorporate them into the final draft, e.g., including the following points:
Equation (1) will be rewritten to separately define $L\_{\mathrm{enc}}$ apart from the $\mathrm{argmin}$ formulation. The distance notations will be clarified, e.g., by standardizing the use of $\epsilon$ in place of $\eta$ for consistency. A simplified version of Algorithm 1 will be incorporated into the main text. The font sizes of Figure 2 and 4 will be increased to improve readability.

---

Q4. Figure 4: “Worst-case gap”?

We use the term “worst-case gap” in Figure 4 to refer to the drop in protection effectiveness (e.g., in LPIPS) between a protected image before and after the strongest purification attempt among those considered. In other words, it measures how much the protection effect is weakened by the strongest purification. Therefore, the small worst-case gaps of BlurGuard in Figure 4 show that its protections remain robust even under aggressive purification attacks. This trend holds consistently across a wide range of protection budgets; e.g., including those from $\epsilon=\tfrac{1}{255}$, as you mentioned, up to $\epsilon=\tfrac{16}{255}$. We will clarify this point in the final draft.

---

[1] Liang et al., Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. ICML 2023.
[2] Liang & Wu, Mist: Towards improved adversarial examples for diffusion models. 2023.
[3] Polesel et al., Image enhancement via adaptive unsharp masking. IEEE TIP 2000.

---

Dear Reviewer Y1wo,

Thank you again for your time and effort in reviewing our manuscript.

As we are now midway through the discussion period, we would like to kindly check if you have any remaining questions or concerns we could help clarify.

We believe we have made a sincere effort to address your earlier comments, and would be happy to receive any additional feedback you may have.

Your insights are invaluable and would greatly help us further strengthen our manuscript.

Best regards,
Authors

We sincerely appreciate your thoughtful and constructive feedback. We respond to each of your questions one-by-one in what follows. Should you have any additional comments or concerns, we would be happy to discuss or clarify them.

---

Q1. Additional baselines

Thank you for suggesting additional baselines. In our experiments, we selected our baselines that are most commonly considered in recent literature on adversarial image protection. We note that we also made an effort to include more recent techniques where possible, e.g., DiffusionGuard (2025) [1] and High-Frequency Anti-DreamBooth (2024) [2], as well as state-of-the-art purification-based defenses like GrID‑Pure (2024) [3] and PDM‑Pure (2024) [4]. In response to your suggestion, we have additionally compared BlurGuard with EditShield [5] you mentioned, although we were unfortunately unable to include “Distraction is All You Need” [6] due to the lack of publicly available code. As summarized in the table below, the results further confirm the strong robustness of BlurGuard as a natural and effective image protection method. We will incorporate these and more results in the final draft.

---

Q2. Table 9: Clarification on PSNR results

We remark that PSNR primarily captures pixel-wise differences to measure naturalness, and accounts less for perceptual relevance; often penalizing even imperceptible changes. BlurGuard intentionally applies stronger perturbations in perceptually insensitive regions to improve robustness while maintaining visual quality. These imperceptible changes can slightly lower PSNR, despite not affecting human perception. This aspect is better reflected in stronger performance on perceptual metrics like SSIM and LPIPS, and is further supported by qualitative results in Figure 11 in Appendix. We will clarify this point in the final version.

---

Q3. Discussion on non-diffusion editing methods

We acknowledge that the transferability of adversarial image protection methods, e.g., to non-diffusion editing methods, is an important step toward increasing their practical applicability. In particular, the question of whether adversarial perturbations crafted for one type of editor (e.g., a diffusion model) can effectively transfer to other types of (black-box) editing tools, e.g., GAN-based models, remains a technically challenging and, to our knowledge, under-explored problem. In this work, we focus on diffusion-based pipelines, as they currently represent the most widely used class of image editing models in both academic and commercial settings. We think extending BlurGuard to cover non-diffusion editors is a promising future direction, and we will reflect this point in the final draft by revising the discussion of limitations (e.g., in Appendix A.2).

---

Q4. “I.A.”: Should be defined in the main text

Thank you for the incisive comment. We will ensure that the I.A. metric is clearly defined and explained in the main text of the final draft.

---

[1] Choi et al., DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR 2025.
[2] Onikubo et al., High-Frequency Anti-DreamBooth: Robust Defense against Personalized Image Synthesis. ECCV Workshop 2024.
[3] Zhao et al., Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion? CVPR 2024.
[4] Xue et al., Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think. 2024.
[5] Chen et al., EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models. ECCV 2024.
[6] Lo et al., Distraction is all you need: Memory-Efficient Image Immunization against Diffusion-Based Image Editing. CVPR 2024.

---

Dear Reviewer fDxR,

Thank you again for your time and effort in reviewing our manuscript. We are also delighted and encouraged by your positive review, and we truly appreciate your support for our manuscript.

As we are now midway through the discussion period, we would like to kindly check if you have any remaining questions or concerns we could help clarify.

We believe we have made a sincere effort to address your earlier comments, and would be happy to receive any additional feedback you may have.

Your insights are invaluable and would greatly help us further strengthen our manuscript.

Best regards,
Authors