VETO: Towards Protecting Images From Frontier AI Editing

2026-07-29

AI Summary

This work addresses the challenge posed by modern AI image editing models, which enable highly realistic non-local semantic manipulations that evade conventional defenses. To counter this threat, we propose VETO, an anti-editing invisible cloak specifically designed against contemporary diffusion-based editors relying on cross-attention mechanisms. VETO injects adversarial perturbations into source image tokens to disrupt their representation within the cross-attention layers, thereby preventing the editor from effectively reading the original content. Our approach is the first defense tailored to this emerging editing paradigm, and we introduce VetoBench—a new evaluation benchmark encompassing global recontextualization scenarios. Extensive experiments demonstrate that VETO consistently outperforms existing methods across two state-of-the-art editing models and three benchmarks, achieving superior protection performance while preserving high visual fidelity.

Abstract

The rise of powerful, accessible image-editing models such as FLUX.2 has brought high-fidelity editing within broad reach. Their capabilities now extend beyond localized modifications to extracting and recontextualizing objects and identities in entirely new scenes. By allowing prompt and generation tokens to attend directly to reference-image tokens, modern models blur the boundary between conventional editing and text-to-image synthesis. This expanded generative freedom also broadens the space of potential misuse, as harmful transformations are no longer confined to a predictable set of localized edits. Existing anti-edit defenses are designed to disrupt the semantic bottleneck of the reference-image encoding in legacy diffusion pipelines. However, newer editors distill reference information through joint-attention blocks, thereby often circumventing these protections. We therefore introduce VETO, a subtle anti-edit cloak that disrupts this inner mechanism through which modern models read the source image. Additionally, as existing editing benchmarks leave comprehensive recontextualizations largely untested, we introduce VetoBench, which evaluates defenses not only on conventional localized edits but also on broader contextual shifts. Across two contemporary editing models and three benchmarks, VETO consistently outperforms existing defenses while providing a stronger protection-fidelity trade-off.

Problem

• image editing
• AI misuse
• anti-edit defense
• recontextualization
• generative models

Innovation

• anti-edit defense
• joint-attention disruption
• image recontextualization
• VETO
• VetoBench