Protecting Against Malicious Use of Image Diffusion Models

生成AI能力的快速发展伴随着其滥用范围的增加。特别是，文本到图像的扩散模型，如DALL-E 2已经达到了一个点，在这个点上，高质量的图像可以轻松地由广泛的用户生成，而不是所有的用户都有良好的意图。这个博士项目的目的是研究如何防止恶意使用这种技术。文本到图像扩散模型的目标是基于文本提示生成逼真的图像。这些模型通过使用正向过程来工作，该过程依次向输入图像添加噪声，然后学习映射以逆转该过程。然后，从噪声开始，我们可以使用训练好的模型对输入文本的图像进行降噪，最终得到一个与输入图像分布相同的输出图像。我们可以修改现有模型中的参数，以改变它们的行为，而不是重新训练或改变这些模型的工作方式。这种方法的一个示例用例是编辑这些模型中发现的隐式偏差。文本到图像扩散模型的训练数据中的隐式偏见可能导致生成图像时的社会和文化偏见。例如，向扩散模型询问奶牛的图像，即使从未指定环境，也很有可能返回田野中奶牛的图像。性别偏见也存在于这些模型中，在生成某些职业的人的图片时很明显。由于重新训练模型以避免这些偏差是昂贵和耗时的，因此TIME等方法希望在训练后编辑模型的权重，以降低发生所选偏差的可能性。在方法上仍有大量的分析工作要做。一些示例包括：编辑事实后模型性能如何受到影响？我们如何在TIME方法的一个应用中减少更广泛的偏差？使用图像扩散模型的图像处理是另一个新兴问题。这些工具的可用性和易用性允许自由编辑任何图像，几乎没有防止恶意意图的保护措施。图像修复是获取现有图像并使用模型仅生成图像的特定区域的过程。这可能被滥用的一个例子是编辑一个人的图像的背景，使其看起来好像他们在其他地方。已经提出了一种方法来保护图像免受此过程的影响，方法是向图像添加特定的扰动，使扩散模型难以生成所提示的内容。该项目将包括对这些技术和其他潜在预防战略的分析。

The rapid advancement in the capabilities of generative AI has been accompanied by an increase in scope for their misuse. In particular, text-to-image diffusion models such as DALL-E 2 have reacheda point at which high quality images can be generated with ease by a broad spectrum of users, not all of whom may have good intent. The aim of this PhD project is to investigate how to protect againstmalicious use of this technology. The goal of a text-to-image diffusion model is to generate realistic images based on a text prompt. These models work by using a forward process which sequentially adds noise to an input image and then learns a mapping to reverse this process. Then, starting with noise, we can use the trained model to denoise the image conditioned on the input text and end up with a output image that appears to come from the same distribution as the input images. Instead of retraining or changing how these models work, we can modify parameters in existing models to change their behaviour to be more desirable. One example use case for this methodology is editing implicit biases found in these models. Implicit biases in the training data for text-to-image diffusion models, can lead to perpetuating social and cultural biases when generating images. As an example, asking a diffusion model for an image of a cow will, with high probability, return an image of a cow in a field even although the environment was never specified. Gender biases are also present in these models which is noticeable when generating pictures of people in certain professions. Since retraining the model to avoid these biases is expensive and time consuming, methods such as TIME look to edit the weights of the model after training in order to reduce the likelihood of a chosen bias occurring. There is still a large amount of analysis to be done into the methodology. Some examples include: How is model performance impacted after editing facts? How can we reduce a broader range of biases in one application of the TIME method? Image manipulation using image diffusion models is another emerging issue. The availability and ease at which these tools can be used allow any image to be edited freely, with little in the way of safeguards to prevent malicious intent. In-painting is the process of taking an existing image and using the model to only generate specific areas of the image. One example of how this can be misused is by editing the background of an image of a person to make it appear as if they were somewhere else. Methodology has been proposed to create protections for images against this process, by adding specific perturbations to the image that cause diffusion models to struggle to generate what is prompted. This project would include an analysis into these techniques and other potential prevention strategies.