“Purify Once, Edit Freely” (arXiv:2603.13028) reveals a structural weakness in image protection systems: once you purify an adversarially protected image, the protection is gone permanently, enabling unrestricted editing from that point forward.
The through-claim: one-time defenses fail against persistent threats. Content creators add adversarial perturbations to images to prevent unauthorized diffusion-model editing. These perturbations are tuned to disrupt a specific model. But when the attacker uses a different model (the “model mismatch” scenario), two purification methods — VAE-Trans and EditorClean — can remove the perturbations without knowing anything about the defense. The purified image then becomes permanently editable. Across 2,100 editing tasks and six protection methods, EditorClean consistently restored editability.
The cascading failure is the key insight. If protection were “sticky” — requiring re-defeat for each editing attempt — the defense would still have value. But purification creates a clean copy that can be shared, edited, and distributed indefinitely. One attacker's one-time effort benefits all subsequent attackers. The defense degrades from “hard to break” to “break once, use forever.”
This pattern recurs in DRM (one crack serves all users), copy protection (one rip serves all copies), and watermarking (one removal clears the mark permanently). The common structure: defenses embedded in the content, not enforced by the channel, collapse under model mismatch because the adversarial perturbation has nowhere to hide when the receiving model doesn't match the sending model's expectations.