Evaluate purification-aware perturbations

Evaluate purification-aware perturbations that incorporate a differentiable surrogate of the purification process or otherwise account for diffusion-based image purification during perturbation optimization.

Background

The paper evaluates its diffusion-based geolocation privacy defense against DiffPure, a diffusion-based image-purification method, and finds that purification partially attenuates—but does not eliminate—the defense’s effectiveness. It suggests incorporating a differentiable surrogate of purification into the optimization objective and concentrating perturbation energy in frequency bands that diffusion priors cannot reconstruct. A full evaluation of such purification-aware perturbations is left unresolved.

References

We leave a full evaluation of purification-aware perturbations as future work.

— Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models  (2609.21363 - Wang et al., 18 Sep 2026) in Section 6, subsection “Potential Attacks,” subsubsection “Robustness to Purification”