{"type":"ScholarlyArticle","title":"IdentityMask: A Robust Face-Centric Privacy Protection Against Unauthorized Personalization of Diffusion Models","authors":[{"name":"Weiwei Tan","slug":"weiwei-tan","given":"Weiwei","family":"Tan","affiliation":""},{"name":"Rui Wang","slug":"rui-wang","given":"Rui","family":"Wang","affiliation":""},{"name":"Lihua Jing","slug":"lihua-jing","given":"Lihua","family":"Jing","affiliation":""},{"name":"Yanjun Zhang","slug":"yanjun-zhang","given":"Yanjun","family":"Zhang","affiliation":""},{"name":"Runbo Li","slug":"runbo-li","given":"Runbo","family":"Li","affiliation":""},{"name":"Leo Yu Zhang","slug":"leo-yu-zhang","given":"Leo Yu","family":"Zhang","affiliation":""}],"abstract":"Unauthorized personalization based on diffusion models pose a severe and growing threat to digital privacy by enabling the unauthorized replication and exploitation of individual identities. Existing disrupting-based defenses primarily add invisible perturbations arbitrarily across the entire image space to disrupt the generation process. However, we reveal that these methods fundamentally overlook the spatio-temporal dynamics of the personalization process, resulting in inefficient optimization that fails to sufficiently disrupt the core identity encoding mechanism. To mitigate these limitations, we propose IdentityMask, a robust protection framework that shifts the paradigm from arbitrary confusion to precise, targeted feature corruption. By anchoring the perturbation on subject-specific semantics and prioritizing the most critical diffusion timesteps, our framework ensures the disruption is maximized precisely where the identity is encoded. Additionally, a novel manifold projection strategy is introduced to embed the adversarial signals into the intrinsic structure of the image, rendering the protection resilient against state-of-the-art purification. Extensive experiments across diverse datasets, personalization techniques, and defense settings demonstrate that IdentityMask consistently outperforms prior state-of-the-art approaches in both protection efficacy and robustness.","doi":"10.24963/ijcai.2026/187","url":"https://ijcai.org/proceedings/2026/187","pdf":"https://ijcai.org/proceedings/2026/0187.pdf","markdown":"https://ijcai.org/proceedings/2026/187.md","bibtex":"https://ijcai.org/proceedings/2026/bibtex/187","volume":{"slug":"2026","title":"Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2026","url":"https://ijcai.org/proceedings/2026/","year":2026,"location":"Bremen, Germany","dates":"15-21 August 2026","editors":"Diego Calvanese","isbn":"978-1-956792-09-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2026"},"section":"Computer Vision","track":"Main Track","number":187,"pages":{"first":1676,"last":1684},"keywords":["Computer Vision: Adversarial learning, adversarial attack and defense methods"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}