Do Protective Perturbations Really Protect Portrait Privacy under Real-world Image Transformations?

Abstract

Proactive defense methods protect portrait images from unauthorized editing or talking face generation (TFG) by introducing pixel-level protective perturbations, and have attracted increasing attention for privacy protection. In real-world use, images inevitably undergo sequences of benign operations during display and dissemination, such as resizing and color compression, which directly alter pixel values. Existing studies and robustness defenses mainly examine individual transformations in isolation, while sequentially composed transformations remain underexplored. To address this gap, we systematically evaluate whether representative proactive defenses against unauthorized image editing using GANs and diffusion models, as well as talking face generation, remain effective under sequential image transformations. The evaluated methods span general-purpose and portrait-specific defenses and are assessed qualitatively and quantitatively. Experimental results show that pixel-level perturbation-based defenses struggle to withstand sequences of common image transformations, posing a risk of failure in real-world applications. To further demonstrate that this vulnerability can be exploited at low cost, we introduce Transformation-Induced Purification via Region-wise Super-Resolution (TIP-RSR), a simple training-free framework combining sequential image transformations with off-the-shelf restoration models. TIP-RSR efficiently purifies protective perturbations while preserving image fidelity and requiring substantially less computation than diffusion-based purification methods. These findings expose a practical vulnerability in current proactive portrait defenses and highlight the need to account for sequential real-world transformations when designing future protection mechanisms. Our code is publicly available at https://github.com/Richen7418/TIP-RSR.