{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T05:12:46Z","timestamp":1768281166815,"version":"3.49.0"},"reference-count":73,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62571298"],"award-info":[{"award-number":["62571298"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Tsinghua SIGS KA Cooperation Fund","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2025.3648660","type":"journal-article","created":{"date-parts":[[2025,12,26]],"date-time":"2025-12-26T18:23:11Z","timestamp":1766773391000},"page":"725-740","source":"Crossref","is-referenced-by-count":0,"title":["Toward Dataset Copyright Evasion Attack Against Personalized Text-to-Image Diffusion Models"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5667-8238","authenticated-orcid":false,"given":"Kuofeng","family":"Gao","sequence":"first","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, Guangdong, China"}]},{"given":"Yufei","family":"Zhu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2258-265X","authenticated-orcid":false,"given":"Yiming","family":"Li","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Jurong West, Singapore"}]},{"given":"Jiawang","family":"Bai","sequence":"additional","affiliation":[{"name":"Tencent, Shenzhen, Guangdong, China"}]},{"given":"Yong","family":"Yang","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9653-7907","authenticated-orcid":false,"given":"Zhifeng","family":"Li","sequence":"additional","affiliation":[{"name":"Tencent, Shenzhen, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8639-982X","authenticated-orcid":false,"given":"Shu-Tao","family":"Xia","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, Guangdong, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108834"},{"key":"ref3","first-page":"1","article-title":"Localizing and editing knowledge in text-to-image generative models","volume-title":"Proc. ICLR","author":"Basu"},{"key":"ref4","first-page":"1","article-title":"Data taggants: Dataset ownership verification via harmless targeted data poisoning","volume-title":"Proc. ICLR","author":"Bouaziz"},{"key":"ref5","article-title":"Defending text-to-image diffusion models: Surprising efficacy of textual perturbations against backdoor attacks","author":"Chew","year":"2024","journal-title":"arXiv:2408.15721"},{"key":"ref6","first-page":"1","article-title":"VillanDiffusion: A unified backdoor attack framework for diffusion models","volume-title":"Proc. NeurIPS","author":"Chou"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2985532"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3227945"},{"key":"ref9","article-title":"Retrievals can be detrimental: A contrastive backdoor attack paradigm on retrieval-augmented diffusion models","author":"Fang","year":"2025","journal-title":"arXiv:2501.13340"},{"key":"ref10","first-page":"1","article-title":"An image is worth one word: Personalizing text-to-image generation using textual inversion","volume-title":"Proc. ICLR","author":"Gal"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/WACV57701.2024.00503"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00390"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01043"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3829"},{"key":"ref16","first-page":"1","article-title":"Domain watermark: Effective and harmless dataset copyright protection is closed at hand","volume-title":"Proc. NeurIPS","author":"Guo"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2018.2815181"},{"key":"ref18","first-page":"1","article-title":"On the feature learning in diffusion models","volume-title":"Proc. ICLR","author":"Han"},{"key":"ref19","article-title":"LoRA: Low-rank adaptation of large language models","author":"Hu","year":"2021","journal-title":"arXiv:2106.09685"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.09.032"},{"key":"ref21","first-page":"1","article-title":"Unlearnable examples: Making personal data unexploitable","volume-title":"Proc. ICLR","author":"Huang"},{"key":"ref22","volume-title":"Ossaili Simple Architecture Blip Captions Dataset","year":"2023"},{"key":"ref23","volume-title":"Pranked03 Flowers Blip Captions Dataset","year":"2023"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3611833"},{"key":"ref25","volume-title":"Landscape Pictures Dataset","year":"2024"},{"key":"ref26","first-page":"1","article-title":"Progressive growing of GANs for improved quality, stability, and variation","volume-title":"Proc. ICLR","author":"Karras"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00246"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00192"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2007.905146"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00073"},{"key":"ref31","first-page":"1","article-title":"Video watermarking: Safeguarding your video from (unauthorized) annotations by video-based LLMs","volume-title":"Proc. ICML Workshop","author":"Li"},{"key":"ref32","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. NeurIPS","author":"Li"},{"key":"ref33","first-page":"1","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"Proc. ICLR","author":"Li"},{"key":"ref34","first-page":"1","article-title":"Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection","volume-title":"Proc. NeurIPS","author":"Li"},{"key":"ref35","article-title":"Rethinking data protection in the (generative) artificial intelligence era","author":"Li","year":"2025","journal-title":"arXiv:2507.03034"},{"key":"ref36","article-title":"CBW: Towards dataset ownership verification for speaker verification via clustering-based backdoor watermarking","author":"Li","year":"2025","journal-title":"arXiv:2503.05794"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3265535"},{"key":"ref38","article-title":"The ArtBench dataset: Benchmarking generative models with artworks","author":"Liao","year":"2022","journal-title":"arXiv:2206.11404"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.02240"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00585"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i5.28226"},{"key":"ref42","first-page":"1","article-title":"DINOv2: Learning robust visual features without supervision","volume-title":"Proc. TMLR","author":"Oquab"},{"key":"ref43","article-title":"Reconstruction of differentially private text sanitization via large language models","author":"Pang","year":"2024","journal-title":"arXiv:2410.12443"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627204"},{"key":"ref45","volume-title":"Pokemon Blip Captions","author":"Pinkney","year":"2022"},{"key":"ref46","article-title":"CertDW: Towards certified dataset ownership verification via conformal prediction","author":"Qiao","year":"2025","journal-title":"arXiv:2506.13160"},{"key":"ref47","first-page":"79320","article-title":"Controlling text-to-image diffusion by orthogonal finetuning","volume-title":"Proc. NeurIPS","author":"Qiu"},{"key":"ref48","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. ICML","author":"Radford"},{"key":"ref49","article-title":"Hierarchical text-conditional image generation with CLIP latents","author":"Ramesh","year":"2022","journal-title":"arXiv:2204.06125"},{"key":"ref50","first-page":"1","article-title":"Transferable unlearnable examples","volume-title":"Proc. ICLR","author":"Ren"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02155"},{"key":"ref53","article-title":"Large-scale classification of fine-art paintings: Learning the right metric on the right feature","author":"Saleh","year":"2015","journal-title":"arXiv:1505.00855"},{"key":"ref54","article-title":"DATABench: Evaluating dataset auditing in deep learning from an adversarial perspective","author":"Shao","year":"2025","journal-title":"arXiv:2507.05622"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00423"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.02858"},{"key":"ref57","article-title":"The information bottleneck method","author":"Tishby","year":"2000","journal-title":"arXiv:physics\/0004057"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/ITW.2015.7133169"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00191"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3386058"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73013-9_7"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3492792"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3185408"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2020.2987164"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00685"},{"key":"ref66","article-title":"Towards faster training of diffusion models: An inspiration of a consistency phenomenon","author":"Xu","year":"2024","journal-title":"arXiv:2404.07946"},{"key":"ref67","first-page":"1","article-title":"On the multi-modal vulnerability of diffusion models","volume-title":"Proc. ICML Workshop","author":"Yang"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3282577"},{"key":"ref69","article-title":"Scaling autoregressive models for content-rich text-to-image generation","author":"Yu","year":"2022","journal-title":"arXiv:2206.10789"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3581783.3612108"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00355"},{"key":"ref72","article-title":"A recipe for watermarking diffusion models","author":"Zhao","year":"2023","journal-title":"arXiv:2303.10137"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2021.3131258"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11316185.pdf?arnumber=11316185","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,12]],"date-time":"2026-01-12T21:59:36Z","timestamp":1768255176000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11316185\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":73,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3648660","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}