NullEdit: Stealthy Image Protection via VLM Condition Redirection

2026-08-11

AI Summary

This work addresses the challenge of unauthorized image editing by proposing an implicit “no-op” defense mechanism that semantically redirects malicious editing instructions during the conditional input stage of vision-language models (VLMs), thereby neutralizing their effect without compromising legitimate edits. Built upon a diffusion Transformer architecture, the method leverages anchor representations from both normal edits and no-edit scenarios to guide representation learning and employs cross-prompt gradient averaging to enhance generalization. Evaluated on the Step1X-Edit and Qwen-Image-Edit benchmarks, the approach reduces the EditReward IF score by an average of 0.813 compared to the current state-of-the-art, while effectively preserving subject identity and source image content without introducing visible artifacts or identity drift.

Abstract

Modern image editors combine vision-language models (VLMs) with diffusion transformer backbones to modify a single reference image according to instructions without fine-tuning. This capability also enables unauthorized manipulation of publicly released images. Existing inference-time defenses either invalidate edits through conspicuous corruption, thereby exposing the protection, or allow them to proceed with identity or reference content drift, thereby failing to prevent the editing behavior itself. We instead target a stealthy and harmless no-op in which the requested edit is suppressed, the output remains natural and source-preserving without conspicuous artifacts or identity replacement, and harmful semantics requested by malicious instructions are absent. We propose NullEdit, which targets the VLM representation jointly formed from the reference image and instruction before it conditions the downstream DiT backbone. Using normal-edit and no-edit anchors, NullEdit redirects this representation, while cross-prompt gradient averaging transfers protection to held out instructions. Across Step1X-Edit and Qwen-Image-Edit on CelebA-HQ and VGGFace2, NullEdit reduces the EditReward IF score by 0.813 on average relative to the SOTA baseline while preserving subject identity and source content.

Problem

• stealthy image protection
• unauthorized image editing
• vision-language models
• diffusion transformer
• inference-time defense

Innovation

• NullEdit
• vision-language model
• stealthy defense
• diffusion transformer
• edit suppression