Neural Plagiarism

Official Implementation of ICCV 2025 paper "Attention to Neural Plagiarism: Diffusion Models Can Plagiarize Your Copyrighted Images!".

[ICCV Page][Poster]

Citation:

@InProceedings{Zou_2025_ICCV,
    author    = {Zou, Zihang and Gong, Boqing and Wang, Liqiang},
    title     = {Attention to Neural Plagiarism: Diffusion Models Can Plagiarize Your Copyrighted Images!},
    booktitle = {Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)},
    month     = {October},
    year      = {2025},
    pages     = {19546-19556}
}

Plagiarism Attack:

Our plagiarism attack is a general, training-free, untargeted attack on copyrighted data. It exploits the attention mechanisms underlying advanced neural models to remove copyright markers, ranging from invisible watermarks to visible signatures.

Example: plagiarize Elon Musk portrait

These attacked images resemble Elon Musk, but none of these can be him without complicated facial surgery or genetic engineering :)

Attack pipeline: Our attack adds shims to anchor variable to diverge the trajectory of the copyrighted data and introduce different level of semantic alterations to bypass copyright protection. As shown below, we can generate a semantic similar plagiarized image without knowing the prompt or watermarking methods of target image. More details can be seen in our poster and paper.

Run an example

See examples for a single-image configuration, existing illustrations, and the input / reconstruction / output report generated by the runner.

Check the configuration without loading models or installing the deep-learning stack:

python run_attack.py --target_folder samples --start 0 --end 1 --start_step 15 --k 25 45 --eps 10 --iters 10 --output_folder outputs/portrait-example --dry-run

After validating the model environment, remove --dry-run to execute. Each completed result is added to outputs/portrait-example/index.html, with configuration and seed metadata alongside it. GPU execution of this refreshed runner is not yet validated. See the environment and evaluation notes.

The old commands referenced optimize_latent_images_folder.py, which is absent from this repository. The old invisible-watermark example also used an unavailable --noisy_start flag. Watermark embedding and detection remain disabled in the current runner; the example gallery does not report detection success rates.

---

Publication resources

• ICCV 2025 publication
• Publication DOI: 10.1109/ICCV51701.2025.01817
• arXiv:2603.00150
• arXiv full text in HTML
• BibTeX citation
• Machine-readable citation
• Zihang Zou on Google Scholar

The conference publication is ICCV 2025, pp. 19546–19556. The arXiv version was submitted on February 25, 2026. The citation files above refer to the ICCV publication.