综述 | Adversarial Attacks for Good：视觉内容生命周期中的主动保护

TL;DR - A survey ("Adversarial Attacks for Good", arXiv:2608.04314, NTU/Melbourne/SMU/Fudan/Sony AI) reframes adversarial perturbations as proactive protection for content owners, organizing five defense families across the visual content lifecycle. It matters because it unifies fragmented communities (privacy, unlearnable data, anti-personalization, CAPTCHA, watermarking) under one comparison framework as scraping/training/generation disputes escalate.

• Lifecycle framing: five stages — sharing, training, generation, platform access, audit/dispute — map to adversarial privacy filters, unlearnable examples, proactive generative immunization, adversarial CAPTCHAs, and provenance/accountability mechanisms.
• Three evaluation axes: transferability (white/gray/black-box access), adaptivity (static vs. routine transforms like compression/resize vs. adaptive purification, retraining, signal removal), and deployment maturity (in-lab demos → external systems → commercial APIs → sustained live evidence).
• Core critique: most claims collapse under adaptivity — purification, denoising, model swaps, checkpoint/LoRA changes, and fine-tuning erode protection; the authors urge reporting attacker cost (extra data, compute, queries, human effort) instead of binary "training blocked".
• Open problems: composable protection stacks across stages, joint reporting of protection strength vs. visual utility and authorized recovery, provenance evidence usable in platform/legal workflows, and stronger threat models from VLMs and GUI/embodied agents that infer identity from context beyond faces.