{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T10:14:36Z","timestamp":1777889676025,"version":"3.51.4"},"reference-count":84,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001321","name":"National Research Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001321","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.01807","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"19439-19449","source":"Crossref","is-referenced-by-count":0,"title":["When and Where Do Data Poisons Attack Textual Inversion?"],"prefix":"10.1109","author":[{"given":"Jeremy","family":"Styborski","sequence":"first","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mingzhi","family":"Lyu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University,Rapid-Rich Object Search (ROSE) Lab,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiayou","family":"Lu","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nupur","family":"Kapur","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Adams Wai-Kin","family":"Kong","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University,Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-021-10125-w"},{"key":"ref2","article-title":"AUTOMATIC1111","year":"2022","journal-title":"Stable Diffusion Web UI"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01764"},{"key":"ref4","article-title":"Poisoning and backdooring contrastive learning","volume-title":"International Conference on Learning Representations","author":"Carlini","year":"2022"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref6","article-title":"Diffusionguard: A robust defense against malicious diffusion-based image editing","volume-title":"The Thirteenth International Conference on Learning Representations, 2025","author":"Choi"},{"key":"ref7","year":"2025","journal-title":"CivitAI"},{"key":"ref8","author":"Cohen","year":"2019","journal-title":"Certified adversarial robustness via randomized smoothing"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/cvprw50498.2020.00359"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref11","article-title":"Taylor","author":"DeVries","year":"2017","journal-title":"Improved regularization of convolutional neural networks with cutout"},{"key":"ref12","volume-title":"Diffusion models beat gans on image synthesis","author":"Dhariwal","year":"2021"},{"key":"ref13","article-title":"Dolatabadi, Sarah Erfani, and Christopher Leckie","author":"M","year":"2024","journal-title":"The devil\u2019s advocate: Shattering the illusion of unexploitable data using diffusion models"},{"key":"ref14","author":"Fowl","year":"2021","journal-title":"Adversarial examples make strong poisons"},{"key":"ref15","author":"Gal","year":"2022","journal-title":"An image is worth one word: Personalizing text-to-image generation using textual inversion"},{"key":"ref16","article-title":"Imagenet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","volume-title":"International Conference on Learning Representations","author":"Geirhos","year":"2019"},{"key":"ref17","article-title":"Goodfellow, Jonathon Shlens, and Christian Szegedy","author":"J","year":"2015","journal-title":"Explaining and harnessing adversarial examples"},{"key":"ref18","author":"Gu","year":"2023","journal-title":"Mix-of-show: Decentralized low-rank adaptation for multi-concept customization of diffusion models"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00673"},{"key":"ref20","author":"Hertz","year":"2022","journal-title":"Prompt-to-prompt image editing with cross attention control"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.595"},{"key":"ref22","author":"Heusel","year":"2018","journal-title":"Gans trained by a two time-scale update rule converge to a local nash equilibrium"},{"key":"ref23","author":"Ho","year":"2022","journal-title":"Classifier-free diffusion guidance"},{"key":"ref24","author":"Ho","year":"2020","journal-title":"Denoising diffusion probabilistic models"},{"key":"ref25","article-title":"Hu, Yelong Shen, Phillip Wallis, Zeyuan AllenZhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen","author":"J","year":"2021","journal-title":"Lora: Low-rank adaptation of large language models"},{"key":"ref26","author":"Huang","year":"2021","journal-title":"Unlearnable examples: Making personal data unexploitable"},{"key":"ref27","author":"Huang","year":"2017","journal-title":"Adversarial attacks on neural network policies"},{"key":"ref28","author":"Jiang","year":"2020","journal-title":"Robust pre-training by adversarial contrastive learning"},{"key":"ref29","article-title":"Pnp inversion: Boosting diffusion-based editing with 3 lines of code","volume-title":"The Twelfth International Conference on Learning Representations","author":"Ju","year":"2024"},{"key":"ref30","author":"Kim","year":"2020","journal-title":"Adversarial self-supervised contrastive learning"},{"key":"ref31","author":"Kingma","year":"2022","journal-title":"Auto-encoding variational bayes"},{"key":"ref32","article-title":"Kingma, Tim Salimans, Ben Poole, and Jonathan Ho","author":"P","year":"2023","journal-title":"Variational diffusion models"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00371"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/spw.2018.00014"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00192"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00202"},{"key":"ref38","author":"Liang","year":"2023","journal-title":"Mist: Towards improved adversarial examples for diffusion models"},{"key":"ref39","author":"Liang","year":"2023","journal-title":"Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/WACV57701.2024.00532"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00747"},{"key":"ref42","author":"Liu","year":"2022","journal-title":"Flow straight and fast: Learning to generate and transfer data with rectified flow"},{"key":"ref43","author":"Liu","year":"2024","journal-title":"Instaflow: One step is enough for high-quality diffusion-based text-to-image generation"},{"key":"ref44","author":"Liu","year":"2024","journal-title":"Image watermarks are removable using controllable regeneration from clean noise"},{"key":"ref45","author":"Liu","year":"2023","journal-title":"Image shortcut squeezing: Countering perturbative availability poisons with compression"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00218"},{"key":"ref47","author":"Lyu","year":"2021","journal-title":"Gradient descent on two-layer nets: Margin maximization and simplicity bias"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612034"},{"key":"ref49","author":"Madry","year":"2019","journal-title":"Towards deep learning models resistant to adversarial attacks"},{"key":"ref50","volume-title":"Sdedit: Guided image synthesis and editing with stochastic differential equations","author":"Meng","year":"2022"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/wacv61041.2025.00207"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr52729.2023.00585"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72633-0_7"},{"key":"ref54","author":"Oquab","year":"2024","journal-title":"Dinov2: Learning robust visual features without supervision"},{"key":"ref55","volume-title":"Sdxl: Improving latent diffusion models for high-resolution image synthesis","author":"Podell","year":"2023"},{"key":"ref56","author":"Radford","year":"2021","journal-title":"Learning transferable visual models from natural language supervision"},{"key":"ref57","author":"Ramesh","year":"2022","journal-title":"Hierarchical text-conditional image generation with clip latents"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02155"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.52202\/068431-2643"},{"key":"ref61","author":"Salman","year":"2023","journal-title":"Raising the cost of malicious ai-powered image editing"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1833"},{"key":"ref63","author":"Shan","year":"2023","journal-title":"Glaze: Protecting artists from style mimicry by text-to-image models"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00207"},{"key":"ref65","article-title":"Shidoto","year":"2025","journal-title":"Shidoto\/adversecleaner: Remove adversarial noise from images"},{"key":"ref66","author":"Song","year":"2022","journal-title":"Denoising diffusion implicit models"},{"key":"ref67","author":"Song","year":"2020","journal-title":"Generative modeling by estimating gradients of the data distribution"},{"key":"ref68","author":"Song","year":"2021","journal-title":"Score-based generative modeling through stochastic differential equations"},{"key":"ref69","author":"Styborski","year":"2024","journal-title":"Exploiting supervised poison vulnerability to strengthen self-supervised defense"},{"key":"ref70","author":"Szegedy","year":"2014","journal-title":"Intriguing properties of neural networks"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.52591\/lxai2018120315"},{"key":"ref72","volume-title":"Diffusers: State-of-the-art diffusion models","author":"von Platen","year":"2022"},{"key":"ref73","author":"Voynov","year":"2023","journal-title":"P+: Extended textual conditioning in text-toimage generation"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01461"},{"key":"ref75","article-title":"Wikipedia","year":"2025","journal-title":"Multivariate normal distribution"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref77","author":"Xue","year":"2024","journal-title":"Pixel is a barrier: Diffusion models are more adversarially robust than we think"},{"key":"ref78","article-title":"Toward effective protection against diffusion-based mimicry through score distillation","volume-title":"The Twelfth International Conference on Learning Representations","author":"Xue","year":"2024"},{"key":"ref79","article-title":"Which features are learnt by contrastive learning?","author":"Xue","year":"2023","journal-title":"on the role of simplicity bias in class collapse and feature suppression"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00612"},{"key":"ref81","author":"Zhang","year":"2018","journal-title":"mixup: Beyond empirical risk minimization"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00355"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28565"},{"key":"ref84","author":"Zhao","year":"2024","journal-title":"Invisible image watermarks are provably removable using generative ai"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11445222.pdf?arnumber=11445222","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T05:19:02Z","timestamp":1777612742000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11445222\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":84,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.01807","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}