DDIM Inversion as a Perturbation Amplifier: Breaking Mimicry Protection via Reconstruction Error Minimization

Personalization techniques for image generation models have increasingly been misused for malicious purposes, including unauthorized style imitation and copyrighted content replication. In response, recent mimicry protection methods embed carefully designed perturbations into images to disrupt a model’s ability to learn genuine semantic representations. Despite their growing adoption, the robustness of these protection mechanisms remains poorly understood, raising concerns about their reliability in real-world deployment. In this work, we present the first systematic analysis showing that DDIM inversion inherently acts as a perturbation amplifier, causing protected images to suffer severe structural distortions during reconstruction. Building on this observation, we propose DDIM Inversion-based Reconstruction Purification (DIRP), a novel purification approach that removes protective perturbations by explicitly minimizing DDIM inversion reconstruction error under perceptual constraints. Extensive experiments on six existing mimicry protection methods demonstrate that DIRP consistently outperforms five state-of-the-art attack baselines, achieving superior perturbation removal while better preserving image quality. Our results expose fundamental vulnerabilities in current mimicry protection strategies and highlight the urgent need for more robust and principled defenses.

Image generation models can now be customized to imitate a person’s visual style or reproduce specific kinds of content, which raises serious concerns for artists, designers, and copyright holders. To prevent this misuse, recent protection methods add tiny, carefully designed changes to images so that AI models cannot easily learn from them. However, it has remained unclear whether these protections are reliable when used in real-world settings. In this work, we study why several existing image protection methods can fail. We find that a common reconstruction process used in image generation systems can unintentionally amplify the hidden protective changes, causing protected images to become visibly distorted during reconstruction. Based on this insight, we develop a new method that removes these protective changes while keeping the image visually close to the original. We test our method against six existing protection approaches and compare it with seven strong removal methods. Our results show that current protection techniques are more fragile than previously understood. This highlights the need for stronger, better-founded defenses to protect creators from unauthorized imitation and content misuse.