无法窃取我的面容：针对身份保持个性化生成的主动防御
No Way To Steal My Face: Proactive Defense Against Identity-Preserving Personalized Generation
针对身份保持的个性化生成（如数字头像、虚拟试衣）中的隐私泄露问题，提出一种模型无关的主动防御框架，通过对抗扰动同时破坏身份特征提取和注入两个阶段，可推广到基于训练和无训练的个人化方法。
原文依据 IDGuardian--the first generalizable and model-agnostic identity protection framework capable of defending against both training-based and training-free personalization methods.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论近期扩散模型的进展使得高保真、身份保持的图像生成成为可能，应用于数字头像和虚拟试衣等个性化场景。然而，这些方法依赖敏感的人脸参考图像，引发了日益增长的隐私担忧。现有防御机制主要针对基于训练的个人化方法设计，由于身份集成范式的根本差异，难以泛化到新兴的免训练方法。为弥补这一差距，我们提出IDGuardian——首个可泛化且模型无关的身份保护框架，能够防御基于训练和免训练的个人化方法。IDGuardian将个人化过程抽象为两个关键阶段：身份提取和身份注入，然后引入精心设计的对抗扰动来同时破坏这两个阶段。具体而言，它降低外部编码器提取的身份特征质量，并建立对抗性概念桥梁，将生成轨迹误导至远离目标身份。大量实验表明，IDGuardian在各种个人化流程和模型架构中有效保护身份，同时对后处理、自适应攻击和跨数据集泛化保持鲁棒。
英文原文摘要 1353 字符
Recent advances in diffusion models have enabled high-fidelity, identity-preserving image generation for personalized applications such as digital avatars and virtual try-on systems. However, their reliance on sensitive facial reference images raises growing privacy concerns. Existing defense mechanisms are primarily designed for training-based personalization and struggle to generalize to emerging training-free approaches, due to fundamental differences in their identity integration paradigms. To bridge this gap, we propose IDGuardian--the first generalizable and model-agnostic identity protection framework capable of defending against both training-based and training-free personalization methods. IDGuardian abstracts the personalization process into two critical stages: identity extraction and identity injection. It then introduces crafted adversarial perturbations to simultaneously disrupt both stages. Specifically, it degrades the identity features extracted by external encoders and establishes an adversarial conceptual bridge that misdirects the generative trajectory away from the target identity. Extensive experiments show that IDGuardian effectively protects identity across various personalization pipelines and model architectures, while remaining robust to post-processing, adaptive attacks, and cross-dataset generalization.