🛡️ VETO: Towards Protecting Images From Frontier AI Editing

Official PyTorch implementation
"VETO: Towards Protecting Images From Frontier AI Editing"

---

Table of contents

• Setup
  • Installation
  • Models
  • Dataset
• Protection
  • Run
  • Config
  • Entropy slices
• Demo
• Evaluation
• Outputs
• Project layout
• Citation

---

📦 Setup

Installation

pip install uv
uv sync

Models

Weights are downloaded from Hugging Face on first run (accept model licenses):

Dataset

VetoBench is our anti-edit benchmark released on Hugging Face. It contains 300 images across three categories (100 each). Every category is split evenly into 50 closed-frame and 50 open-frame edits:

• Closed-frame — modify the original scene in place.
• Open-frame — extract referenced entities or traits and recontextualize them in synthesized scenes.

Each category directory must contain:

• images/ (or flat images under images/base/)
• prompts.csv with columns idx, original_prompt, editing_instruction, edited_prompt

Set data.dataset_dir in your protection config to the category folder you want to evaluate.

---

🔐 Protection

Run

uv run python run_protection.py --config configs/protection/flux2.yaml
uv run python run_protection.py --config configs/protection/fibo_edit.yaml

Protected images are written under outputs/images/{dataset}/{run_id}/protected/images/.

Config

Example: configs/protection/flux2.yaml

Surrogate prompt — encoded once per image and reused for every PGD step. Use "" for unconditional optimization.

MMDiT blocks (double_stream / single_stream):

Constraints (perturbation.constraint.type) — control how the perturbation δ is bounded during PGD:

Optional logging: set run.wandb.enabled: true and run.wandb.entity in the config.

Entropy slices

Slices are defined on the joint sequence [text | canvas | reference]:

---

🖥️ Demo

Try the interactive Gradio demo on Hugging Face Spaces, or run it locally:

uv run python demo/app.py

Opens a FLUX.2 demo (default: http://0.0.0.0:7860) where you can protect an image, run the same edit on the unprotected and protected versions, and compare the results side by side.

---

📊 Evaluation

Pipeline: edits → fidelity → CLIP → optional VQA.

uv run python -m veto.evaluation.runner \
  --run-id <run_id> \
  --dataset-dir /path/to/dataset \
  --vqa-models gemini gpt qwen llava gemma3

API keys for cloud VQA: GEMINI_API_KEY, OPENAI_API_KEY. Local VLMs (qwen, llava, gemma3) need no API key.

---

📂 Outputs

Default root: outputs/

outputs/
  images/{dataset}/{run_id}/protected/images/
  results/{dataset}/{run_id}/evaluations/base/
  metrics/{dataset}/{run_id}/evaluations/base/

---

🗂️ Project layout

configs/protection/
  flux2.yaml              # FLUX.2 protection config
  fibo_edit.yaml          # FIBO Edit protection config
demo/                     # Gradio demo
run_protection.py         # protection entry point
veto/
  configs/                # shared project config
  protection/             # VETO objective, PGD engine, DiT wrappers, attention hooks
  evaluation/             # fidelity, CLIP, VQA
  editing/                # FLUX.2 and FIBO Edit edit backends
  data/                   # prompts.csv loader
  utils/

---

📚 Citation

If you find this work useful, please cite:

@misc{grebe2026vetoprotectingimagesfrontier,
      title={VETO: Towards Protecting Images From Frontier AI Editing}, 
      author={Jonas Grebe and Hossein Shakibania and Tobias Braun and Marcus Rohrbach and Anna Rohrbach},
      year={2026},
      eprint={2607.27292},
      archivePrefix={arXiv},
      primaryClass={cs.CV},
      url={https://arxiv.org/abs/2607.27292}, 
}