ECCV 2026

Universal Image Immunization against Diffusion-based Image Editing via Semantic Injection

Chanhui Lee¹ Donggyu Choi² Seunghyun Shin² Hae-gon Jeon³ Jeany Son¹

¹POSTECH ²GIST ³Yonsei University

Paper Code (coming soon)

Universal image immunization comparison and efficiency trade-off — **Universal immunization overview.** Image-specific defenses require slow per-image optimization, while optimization-free defenses still rely on a learned generator at inference time. Our method precomputes a universal perturbation once and protects images with a simple additive operation, achieving GPU-free, near-zero-cost inference while maintaining strong immunization performance.

A single universal perturbation can immunize images by injecting target semantics and suppressing malicious diffusion-based edits.

Abstract

Recent advances in diffusion models have enabled powerful image editing capabilities guided by natural language prompts, unlocking new creative possibilities while also introducing ethical and legal risks such as deepfakes and unauthorized content manipulation. Image immunization has emerged as a promising defense against AI-driven semantic manipulation, but most existing approaches rely on image-specific adversarial perturbations that require individual optimization for each image.

We propose the first universal image immunization framework that generates a single, broadly applicable adversarial perturbation for diffusion-based editing pipelines. Our method embeds a semantic target into protected images while suppressing original content, misdirecting the editing model's attention and blocking malicious edits through semantic injection.

Method Overview

Target semantic injection framework for universal image immunization — **Target semantic injection.** During training, the universal perturbation is optimized to inject a chosen target semantic into source images while suppressing other source semantics. At inference, the immunized image guides the diffusion editor toward the injected target concept, causing malicious text-guided edits to ignore the original source content and fail.

Qualitative Results

Qualitative comparison with image immunization baselines — **Comparison with prior defenses.** Across diverse source images and malicious editing prompts, universalized baselines and image-specific methods often preserve or transform the original content according to the prompt. Our universal perturbation redirects the editing process toward the injected target semantic, preventing the intended malicious edit with a single reusable perturbation.

BibTeX

@inproceedings{lee2026universal,
  title={Universal Image Immunization against Diffusion-based Image Editing via Semantic Injection},
  author={Lee, Chanhui and Choi, Donggyu and Shin, Seunghyun and Jeon, Hae-gon and Son, Jeany},
  booktitle={European Conference on Computer Vision (ECCV)},
  year={2026}
}