With the growing concerns over copyright infringement in diffusion-based customization, adversarial attacks have emerged as a prominent defense strategy to prevent malicious content forgery in personalized image generation. However, current defenses typically introduce persistent perturbations in the latent space of Latent Diffusion Models (LDMs), which remain susceptible to adaptive bypasses by adversaries. In this paper, we introduce Two-Stage Latent Feature Optimization (TS-LFO), an efficient and effective copyright-stealing attack against protected diffusion-based customization. We begin by observing that existing defenses primarily disrupt the mapping between input images and their latent representations, thereby degrading the model's ability to produce personalized outputs. To counteract this, TS-LFO restores the broken mapping through a two-stage optimization process. In the Latent Denoising Stage, we enhance semantic consistency between latent codes and input images by jointly minimizing a Latent-Image Alignment Loss and a Latent Diffusion Loss with timestep-dependent weights, effectively suppressing the high-frequency noise introduced by defenses. In the Latent Reconstruction Stage, we recover low-frequency semantic information using pixel-level constraints to refine the latent features. Extensive experiments show that TS-LFO consistently bypasses state-of-the-art (SOTA) copyright defenses and outperforms SOTA copyright attacks such as DiffPure, GrIDPure and IMPRESS across diverse settings.

翻译：随着扩散模型定制化领域版权侵权问题的日益严峻，对抗攻击已成为阻止个性化图像生成中恶意内容伪造的主流防御策略。然而，现有防御机制通常会在潜在扩散模型的潜在空间中引入持续性扰动，这仍存在被攻击者自适应规避的风险。本文提出两阶段潜在特征优化方法——一种针对受保护扩散定制化模型的高效版权窃取攻击。我们首先观察到，现有防御主要破坏输入图像与其潜在表示之间的映射关系，从而削弱模型生成个性化输出的能力。为此，TS-LFO通过两阶段优化过程恢复被破坏的映射：在潜在去噪阶段，通过联合最小化潜在-图像对齐损失与带时间步依赖权重的潜在扩散损失，增强潜在编码与输入图像的语义一致性，有效抑制防御引入的高频噪声；在潜在重建阶段，利用像素级约束恢复低频语义信息以优化潜在特征。大量实验表明，TS-LFO在多种设定下持续规避最先进版权防御，并显著超越DiffPure、GrIDPure及IMPRESS等现有版权攻击方法。