VisiLock：基于双分数蒸馏的指令图像编辑授权控制
VisiLock: Authorizing Instruction-based Image editing with Dual Score Distillation
提出将访问控制内嵌到扩散模型权重中的双教师分数蒸馏框架，为视觉生成模型的知识产权保护提供了一种可抵抗对抗微调的权重锁定方案，可复用于其他条件生成模型的授权控制。
原文依据 access control is baked into model weights, rendering the model unusable without a visual trigger in the input
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论尽管开源指令引导的图像编辑模型加速了研究进展，但也将模型能力的控制权交给了任何下载权重的人。现有的保护方法是反应式的：它们在生成后验证所有权，但底层模型对未授权用户仍完全可用。我们提出 VisiLock，将访问控制内嵌到模型权重中，使得在没有输入中的视觉触发器时模型不可用。挑战在于训练一个模型，使其对授权输入保留编辑能力，而对未授权输入保持不可用，同时不破坏训练稳定性。朴素的多任务目标会产生梯度冲突导致训练崩溃，而 FMLock 等对比方法会破坏去噪流形。我们开发了双分数蒸馏，一种双教师框架，其中退化教师定义锁定行为，原始教师引导编辑质量，通过分离的冻结目标消除梯度干扰。一个关键风险是发布的模型可能通过事后微调被解锁。为防止这一点，我们从退化教师初始化学生模型，使其从锁定状态开始，仅通过蒸馏对授权输入恢复编辑能力。这阻碍了对抗性微调恢复完整编辑能力。在 InstructPix2Pix 上的评估表明，授权编辑保持基线质量（CLIP-I: 0.821, DINO: 0.726），而未授权尝试显著退化（CLIP-I: 0.481, DINO: 0.072），图像和语义相似度分别下降 41% 和 90%。该锁定对关键损坏、空间扰动和对抗性解锁微调保持鲁棒。代码将在 https://github.com/Luvata/VisiLock 提供。
英文原文摘要 1756 字符
While open-sourcing instruction-guided image editing models accelerates research, it surrenders control over their capabilities to anyone who downloads the weights. Existing protection methods are reactive: they verify ownership after generation, but the underlying model remains fully functional for unauthorized users. We introduce Visilock, where access control is baked into model weights, rendering the model unusable without a visual trigger in the input. The challenge is training a model that retains editing capability for authorized input and remains unusable for unauthorized input, without destabilizing training. Naive multi-task objectives create gradient conflicts that collapse training, while contrastive approaches like FMLock destroy the denoising manifold. We develop Dual Score Distillation, a dual-teacher framework where a degraded teacher defines locked behavior and an original teacher guides editing quality, eliminating gradient interference through separate frozen targets. A key risk is that released models could be unlocked through post-hoc fine-tuning. To prevent this, we initialize the student model from the degraded teacher so that it begins in a locked state, and only regains editing ability for authorized inputs via distillation. This impedes adversarial fine-tuning from recovering full editing capability. Evaluation on InstructPix2Pix shows authorized edits maintain baseline quality (CLIP-I: 0.821, DINO: 0.726) while unauthorized attempts degrade substantially (CLIP-I: 0.481, DINO: 0.072) with 41% and 90% drops in image and semantic similarity. The lock remains robust to key corruptions, spatial perturbations, and adversarial unlock fine-tuning. Code will be available at https://github.com/Luvata/VisiLock.