Artists protect their images from AI misuse by adding imperceptible perturbations — carefully crafted noise that disrupts diffusion model editing. The defense works: the protected image resists manipulation by the model it was designed to fool. The assumption is that the defense generalizes to other models.
The paper (arXiv:2603.13028, March 2026) shows it does not. When the attacker uses a different diffusion pipeline than the one the defense was optimized against, a single purification step strips the protection entirely. After purification, all editing is unrestricted. The defense assumes the attacker shares your architecture — a fragile assumption in a world of heterogeneous models.
The vulnerability is structural, not incidental. The perturbation is tuned to exploit specific features of the target model's denoising process. A different model's denoising process treats the same perturbation as ordinary noise and removes it during its first pass. The defense is not weak — it is narrow. It defends against exactly one attacker, and the attacker gets to choose which model to use.
The structural lesson: defense by perturbation assumes the attacker's computational substrate. When the defense is a signal designed to disrupt a specific computation, the defense works only as long as the computation remains fixed. In a landscape where new models appear faster than defenses can be retrained, the defense is always fighting the last model. The shield is fragile not because it is poorly made but because it is made for a world that moves.