A Predictable-Image Solution for Copyright Protection Based on Layer-Wise Relevance Propagation

Abstract

As artificial intelligence (AI) systems are increasingly deployed in real-world applications, concerns regarding the unauthorized use of copyrighted images during model training have become more pronounced. In particular, both generative and discriminative models may implicitly internalize distinctive visual patterns from copyrighted data, leading to potential ethical and legal risks even after data removal. In this study, we propose a practical copyright protection framework, termed the Predictable-Image Solution (PIS), which aims to disrupt the learning of copyrighted visual features during the training process. PIS leverages Layer-wise Relevance Propagation (LRP) to identify image regions that contribute positively to a model’s prediction and selectively modifies these regions using non-copyrighted visual substitutes, such as textures or benign image patterns. By targeting semantically influential regions rather than applying global perturbations, the proposed approach effectively interferes with feature extraction while preserving the perceptual quality and overall visual structure of the original image. Extensive experiments conducted on multiple pre-trained image classification models demonstrate that PIS consistently degrades classification performance on protected images, while maintaining high visual similarity as measured by perceptual metrics. These results indicate that PIS offers an effective, model-agnostic, and visually unobtrusive solution for mitigating unauthorized exploitation of copyrighted images in practical AI training scenarios.

1. Introduction

Artificial intelligence (AI) has become deeply integrated into various aspects of modern life, including healthcare, communication, and image generation. Among diverse data modalities, images convey richer semantic information than textual descriptions, making them particularly valuable for visual understanding and content creation. However, the creation of high-quality images requires substantial creativity and human effort. To overcome this limitation, many AI models are trained using copyrighted images without the consent of copyright holders, raising serious ethical and legal concerns. Such unauthorized use not only infringes upon creators’ rights but also undermines artistic motivation. The rapid advancement of generative AI and large-scale datasets has further intensified this issue. When copyrighted images are included in training data, deep learning models inevitably internalize visual features into their parameters. Once learned, these features cannot be easily removed, even if the original data are deleted or access is restricted [1]. Consequently, post-training control mechanisms are fundamentally insufficient for effective copyright protection.

Conventional copyright protection techniques, such as digital watermarking, invisible perturbations, and embedding-based authentication, suffer from inherent limitations. Watermarks can often be removed through post-processing, while invisible perturbations may be detected or neutralized by advanced restoration algorithms. Moreover, these approaches are typically applied post hoc, making them structurally incapable of preventing models from retaining previously learned information.

Recently, research on copyright protection and model security has increasingly focused on explainable artificial intelligence (XAI) techniques for analyzing model behavior. Methods such as saliency maps, Grad-CAM, and relevance-based attribution have been widely used for model interpretation and vulnerability analysis. However, these techniques have largely remained descriptive, and their use as proactive mechanisms for protecting training data remains limited. In contrast, the proposed Predictable-Image Solution (PIS) repurposes relevance information not merely as an explanatory output, but as an active control signal for copyright protection. In this context, a “Predictable-Image” refers to an image whose global semantic structure remains interpretable to human observers, while being intentionally designed to induce misclassification during model learning. In other words, PIS explicitly decouples perceptual predictability for humans from predictive consistency in machine learning models.

This approach is fundamentally distinct from conventional adversarial examples, which typically introduce imperceptible perturbations at inference time to manipulate model outputs. Instead, PIS targets the training stage by preventing the internalization of critical copyrighted features into model parameters. By leveraging Layer-wise Relevance Propagation (LRP) [2,3], the proposed framework identifies image regions that contribute most significantly to classification decisions and selectively replaces these regions with non-copyrighted substitute content. This structured modification preserves the global semantic context while systematically distorting discriminative cues that would otherwise be learned. Extensive experiments across multiple vision architectures demonstrate that PIS effectively degrades classification performance on protected images while maintaining high visual similarity. These results indicate that PIS constitutes a practical, explainable, and learning-stage-oriented copyright protection framework, rather than a post hoc defensive mechanism.

The remainder of this paper is organized as follows. Section 2 reviews existing copyright protection techniques and XAI-based related studies, and discusses their limitations. Section 3 presents the overall architecture of the proposed PIS and describes the relevance-guided image reconstruction method in detail. Section 4 introduces the experimental setup and evaluation metrics across various models. Section 5 provides an analysis and discussion of the experimental results. Finally, conclusions and future research directions are presented.

2. Related Works

2.1. Watermark

Watermarking is one of the most widely adopted techniques for copyright protection in digital images [4]. In general, watermarks are embedded into images as visible or semi-transparent logos, text, or patterns to indicate ownership and discourage unauthorized reproduction. Conventional watermarking approaches rely on spatial- or frequency-domain embedding to ensure traceability and ownership verification. However, the effectiveness of watermarking has been significantly weakened by recent advances in image editing and restoration technologies. Deep learning-based inpainting methods and commercial software, such as Adobe Photoshop, enable the removal of visible watermarks with minimal visual degradation [5,6]. As a result, watermarks can often be erased without compromising image quality, raising serious concerns regarding their robustness against unauthorized reuse. In contrast, the proposed Predictable-Image Solution (PIS) addresses copyright protection at the learning stage by replacing regions that are most influential for model prediction. This strategy prevents models from internalizing copyrighted features, making the recovery of original visual information computationally infeasible.

2.2. Perturbation-Based Protection

Recent studies have proposed perturbation-based protection techniques that insert carefully designed modifications into images in order to disrupt model learning or prevent data extraction [7,8]. These approaches aim to prevent the internalization of sensitive visual features by injecting perturbations into user-provided images during training or fine-tuning. For instance, Fawkes focuses on protecting facial identity against recognition systems, while Glaze is designed to prevent generative models from imitating a specific artistic style.

More recently, protection methods targeting diffusion-based generative models have also been introduced. MetaCloak [9], for example, employs meta-learning-based optimization to generate perturbations that hinder unauthorized diffusion model training. These methods share a similar objective with PIS in that they aim to disrupt unauthorized model learning. Despite their effectiveness, most perturbation-based approaches rely on iterative gradient-based optimization and assume specific target models or training pipelines. As a result, their cross-domain robustness may be limited, particularly for images with complex textures or in large-scale dataset settings. Moreover, the optimization process incurs substantial computational overhead, and the protection effectiveness can vary significantly depending on the target architecture and training configuration.

In contrast, PIS provides a deterministic and lightweight protection mechanism that does not require iterative optimization. Rather than embedding adversarial noise, PIS reconstructs images by selectively modifying semantically critical regions identified through Layer-wise Relevance Propagation (LRP). This relevance-guided reconstruction preserves the global semantic structure from a human perspective, while systematically disrupting the discriminative cues that would otherwise be internalized during model training. Owing to this structural distinction, PIS achieves comparatively stable and reproducible protection performance across diverse image domains and model architectures. To further clarify the differences between existing perturbation-based methods and PIS,

Table 1. Comparison of model-specific objectives and human perception.

Method	Mechanism	Human Perceptibility	Goal
Fawkes	Adversarial perturbation via optimization	Imperceptible	Prevent identity recognition
Glaze	Style-shifting adversarial perturbation	Slightly perceptible	Prevent style mimicry
MetaCloak	Feature-space disruption during training	Mostly imperceptible	Prevent generative training
PIS (Ours)	LRP-guided semantic region substitution	Clearly recognizable by humans	Active protection via predictable misclassification

summarizes their characteristics in terms of target models, protection mechanisms, perceptibility, computational cost, and protection objectives.

2.3. Explainable AI (XAI)

Explainable Artificial Intelligence (XAI) aims to interpret and visualize the internal decision-making processes of deep neural networks. Representative techniques include Grad-CAM [10], Layer-wise Relevance Propagation (LRP) [2], LIME [11], SHAP [12], and Integrated Gradients [13]. These methods have been widely adopted to enhance transparency, fairness, and accountability in machine learning systems [12].

However, existing XAI techniques are primarily designed for diagnostic purposes. They provide post hoc explanations of model behavior but do not inherently prevent the unauthorized use of copyrighted data during training.

The proposed PIS extends XAI beyond interpretability by transforming relevance analysis into an active copyright protection mechanism. By leveraging LRP to identify critical regions and selectively modifying them, PIS obstructs the extraction of meaningful copyrighted features. This approach redefines XAI as a proactive defense strategy rather than a passive explanatory tool.

2.4. Research Gap

In summary, existing copyright protection methods exhibit fundamental limitations. Watermarking techniques rely on post hoc protection and can be easily removed with modern image restoration and editing tools. Perturbation-based approaches are effective in disrupting model training, but often suffer from instability across image domains and incur high computational costs. Meanwhile, explainable AI (XAI) methods primarily focus on interpreting model decisions and do not directly prevent the unauthorized use of copyrighted images during training.

To address this research gap, we propose a novel framework termed the Predictable-Image Solution (PIS), which extends explainability into an active protection mechanism. By leveraging LRP-based relevance analysis, PIS identifies regions that are critical to the model’s classification decision and selectively replaces them to disrupt the learning process itself. Unlike existing approaches, PIS preserves perceptual quality while proactively preventing models from internalizing copyrighted features, offering a model-agnostic and practical solution for copyright protection.

3. Methodology

When training artificial intelligence (AI) models on visual data, individual pixels or regions do not contribute equally to the final prediction. Instead, a limited number of semantically salient regions dominate the decision-making process, while others play a marginal or even suppressive role. To explicitly identify and quantify such contributions, this study adopts Layer-wise Relevance Propagation (LRP) [3], an explainability technique that attributes the model’s output back to the input space.

Based on relevance information obtained via LRP, we propose a Predictable-Image Solution (PIS) that selectively modifies image regions according to their contribution to classification. The core idea is to intentionally disrupt the learning of discriminative visual patterns by altering regions that the model relies on reminding, while preserving overall perceptual plausibility. Figure 1 illustrates example images from the ImageNet-100 dataset processed using the proposed approach.

3.1. Relevance Propagation

Layer-wise Relevance Propagation (LRP) is an attribution method designed to explain a model’s prediction by redistributing the output score backward through the network layers while conserving total relevance [14]. Starting from the output neuron corresponding to the predicted class, relevance scores are propagated layer by layer toward the input, resulting in a relevance map that reflects the contribution of each input unit. Formally, the relevance propagation rule for an input neuron jis given by:

$$R_j=\sum _k{\displaystyle \frac{a_j{w}_{jk}}{ϵ+{\sum }_{0,j}{a}_j{w}_{jk}}}{R}_k,$$

(1)

where $R_j$ denotes the relevance score of neuron j, $a_j$ is its activation, $w_{jk}$ represents the weight connecting neurons j and k, and $ϵ$ is a small stabilizing constant introduced to avoid numerical instability. In this work, we follow the standard formulation commonly adopted in the Layer-wise Relevance Propagation (LRP) literature [2,15]. The role of $ϵ$ is to ensure stable relevance propagation rather than to serve as a tunable hyperparameter. Due to its relevance conservation property, LRP provides faithful localization of decision-critical regions and enables direct analysis of how semantic dependencies shift under image protection mechanisms.

3.2. Selective Region Replacement

Using LRP, relevance scores are computed for each input image and subsequently partitioned into positively and negatively contributing regions [15]. Regions with positive relevance correspond to features that actively support the predicted class, whereas negatively relevant regions suppress or counteract the prediction. Based on this distinction, the proposed PIS applies targeted modifications to each region type. The overall relevance-based image protection procedure is summarized in Algorithm 1.

Algorithm 1 Relevance-Based Image Protection via LRP

Require: Image I, relevance ratios $(\alpha ,\beta )$ Ensure: Protected image $I^{\prime }$   1: $R\leftarrow \mathrm{LRP}\left(I\right)$   2: $R^{+}\leftarrow \mathrm{Top}\text{-}\alpha \%\mathrm{of}R$   3: $R^{-}\leftarrow \mathrm{Bottom}\text{-}\beta \%\mathrm{of}R$   4: Replace $R^{+}$ with external image patches   5: Visual Processing of $R^{-}$   6: Output $I^{\prime }$

Specifically, positively relevant regions are replaced with copyright-free visual content, such as texture patterns, random noise, or semantically unrelated object images. This replacement strategy is intentionally chosen over simple noise injection, as modern deep learning models may ignore or suppress random noise through interpolation or internal denoising mechanisms. In contrast, visually complex patterns originating from different image sources introduce ambiguity during training and inference, thereby preventing the model from consistently learning the original discriminative features. Negatively relevant regions are treated differently. Since these regions do not directly contribute to correct classification, aggressive modification is unnecessary. Instead, mild transformations such as blurring, mosaicing, or color adjustment are applied. In this study, blurring is adopted to maintain overall visual coherence while introducing additional perceptual interference.

3.3. Integration into Predictable-Image Solution (PIS)

The selective replacement and visual adjustment procedures are integrated as a core component of the proposed Predictable-Image Solution (PIS). Unlike post hoc protection strategies that attempt to mitigate privacy or copyright risks after model training, PIS is explicitly designed to disrupt learning at the training stage. By preventing the internalization of critical visual representations associated with copyrighted content, the proposed approach aims to fundamentally reduce the persistence of protected features, even in scenarios where datasets are later removed or modified. Figure 1 presents qualitative examples of images processed using PIS, where noise injection and replacement operations are applied to regions with positive and negative relevance at a ratio of 50%. To further analyze the impact on model behavior, Figure 2 reports the confusion matrices obtained after training a representative ViT-B/16 model under different protection settings.

3.4. Replacement Image Selection Strategy

In the replacement-based perturbation, substitute images were collected from publicly available Wikimedia Commons images [16]. These images were external to the original evaluation dataset, thereby minimizing potential distribution overlap. No specific criteria or class-level constraints were imposed during selection.

To examine whether the observed performance degradation depends on the specific replacement content, we compared noise, texture, and replacement perturbations under identical experimental conditions. As shown in

Table 2. Quantitative experimental results of the three PIS protection variants (noise, replace, and texture) on the ImageNet-100, CIFAR-10, and CIFAR-100 (Subset) datasets. Classification accuracy, mean prediction confidence, and mean entropy are reported to evaluate the degree of learning disruption, while SSIM and PSNR are measured to assess perceptual image quality preservation.Because CIFAR-10 images have very low resolution (32 × 32), PSNR and SSIM metrics are less reliable and provide limited information regarding perceptual quality.

Dataset	Method	Accuracy	Mean_Confidence	Mean_Entropy	Mean_SSIM	Mean_PSNR
ImageNet-100	noise	0.090909	0.918324	0.341966	0.254969	12.78203
	replace	0.090909	0.515685	1.889622	0.296057	14.1461
	texture	0.090909	0.606044	1.52149	0.290198	15.12889
CIFAR-10	noise	0.0	0.912624	5.049304	–	–
	replace	0.0	0.903358	4.930081	–	–
	texture	0.0	0.907134	4.866816	–	–
CIFAR-100 (Subset)	noise	0.0	0.305385	1.904548	0.167871	12.5146
	replace	0.0	0.290138	1.932238	0.257229	15.22556
	texture	0.0	0.306736	1.910972	0.291306	16.49597

, all three perturbation types yielded comparable accuracy (Accuracy ≈ 0.09), indicating a consistent degradation effect across perturbation types. This suggests that the degradation does not strongly depend on the semantic characteristics of the replacement images.

Furthermore, the replacement perturbation produced higher mean predictive entropy compared to the noise-based perturbation, indicating increased output uncertainty rather than bias toward a specific class. In addition, image similarity metrics show that replacement and texture perturbations resulted in slightly higher SSIM and PSNR values compared to noise perturbation. Despite these differences in structural similarity and signal fidelity, the classification accuracy remained equally degraded. This observation further supports the interpretation that the performance drop is not attributable to low-level image distortion alone, but rather reflects model sensitivity to content-level substitution. Therefore, the observed performance degradation is interpreted as reflecting a general vulnerability to content replacement rather than artifacts of particular image selection or simple pixel-level corruption.

4. Experiments

This section describes the experimental setup and evaluation protocol used to verify the effectiveness of the proposed copyright protection framework, namely the Predictable-Image Solution (PIS). The objective of the experiments is to analyze how PIS-protected images affect the learning and inference performance of image classification models, while quantitatively assessing whether perceptual quality and human-recognizable semantic structures are preserved after the application of the protection mechanism.

The experimental data consist of clean (original) images and their corresponding protected images generated using PIS. To explicitly examine the impact of the protection mechanism on model learning, all experiments initialize models with pre-trained weights and perform additional fine-tuning exclusively on protected images for a limited number of epochs. This design allows for a direct observation of how protected images influence learning dynamics.

PIS-protected images are generated based on relevance maps obtained through Layer-wise Relevance Propagation (LRP). According to the model’s prediction, image regions are divided into positive relevance regions and negative relevance regions. Positive relevance regions, which contribute most significantly to classification decisions, are modified through noise injection, replacement with copyright-free substitute images, or texture substitution. In contrast, negative relevance regions are subjected only to limited color transformations, thereby preserving the global structure and semantic coherence of the image while selectively disrupting discriminative visual features.

Model performance is evaluated by comparing classification accuracy before and after protection. Specifically, accuracy obtained by training and evaluating models on clean images (denoted as acc_clean) is compared with accuracy achieved after additional training on protected images (denoted as acc_protected). This comparison provides a quantitative measure of the learning collapse induced by PIS. The perceptual quality of protected images is further assessed using average Peak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) values. In addition, cosine similarity between clean and protected images is computed to analyze feature-level changes caused by the protection process.

The evaluation includes a diverse set of pre-trained architectures, including MobileNet, ResNet-50, EfficientNet, ViT-B/16 [17], Swin-B, and DeiT-B/16, covering both convolutional neural networks (CNNs) and transformer-based models. This broad experimental setup demonstrates that the proposed PIS framework operates in a model-agnostic manner.

Experiments are conducted on publicly available datasets with varying resolutions, visual complexity, and data scales. ImageNet-100 [18,19] is a subset of the large-scale ImageNet dataset consisting of 100 randomly selected classes and high-resolution natural images. CIFAR-10 [20] is a 10-class dataset composed of 32 × 32 color images and is used to analyze learning collapse effects in low-resolution settings. In addition, a small-scale subset of CIFAR-100 is constructed by selecting 10 classes and sampling 15 images per class, resulting in a total of 150 images.

All models are trained under identical optimization settings. Cross-entropy loss is employed as the objective function, and the Adam optimizer is used for training. The initial learning rate is set to $1\times {10}^{-3}$, and training is intentionally limited to three epochs to reflect the small-scale data regime and to directly observe whether protected images can induce learning collapse even under short fine-tuning schedules. No learning rate scheduling is applied.

By limiting the number of images per class across all datasets, the experimental design enables a precise examination of learning collapse and degradation in discriminative performance caused by the protection mechanism. This setup facilitates an analysis of the stability and generalizability of PIS across datasets with different resolutions and data scales.

5. Test Results

This section presents the experimental results obtained using the proposed Predictable-Image Solution (PIS) on the ImageNet-100 dataset. The analysis focuses on how classification performance is affected when PIS-protected images are used as inputs, while simultaneously examining whether visual quality and feature-space similarity are preserved or disrupted.

5.1. Impact of PIS on Classification Accuracy

Figure 3 illustrates the variation in classification accuracy (acc_protected) as a function of protection strength, controlled by the ratios of positively and negatively relevant regions. Figure 3a shows the results obtained using noise-based PIS, whereas Figure 3b presents the results for replacement-based PIS. The noise-based protection scheme significantly degrades classification performance by perturbing relevance-critical regions. In particular, for Transformer-based architectures, partial recovery of accuracy is observed as the proportion of positively relevant regions increases. This behavior suggests that these models can partially compensate for noise-induced perturbations when sufficient discriminative information remains available. In contrast, the replacement-based protection scheme selectively substitutes semantic decision cues while relatively preserving feature-space similarity. As a result, classification accuracy degrades more gradually but remains consistently low across protection ratios, demonstrating a more stable and controlled suppression effect compared to noise-based protection.

5.2. Visual Quality Evaluation

Figure 4 presents a quantitative evaluation of the visual quality of PIS-protected images using PSNR and SSIM metrics. The x-axis denotes the proportion of positively relevant regions replaced with noise or replacement images. Notably, the curves corresponding to all evaluated models nearly overlap across different protection ratios. This observation indicates that the proposed protection method maintains consistent visual quality regardless of the underlying model architecture. These results confirm that PIS introduces minimal perceptual degradation while achieving effective disruption of model learning.

5.3. Feature-Space Similarity Analysis

The relationship between feature-space similarity and classification accuracy after applying PIS is shown in Figure 5. Despite variations in protection ratios, a consistently low accuracy regime is maintained, indicating that PIS is not sensitive to specific hyperparameter settings and can reliably suppress classification performance over a wide range of configurations. An exception is observed for the Swin-B model, which exhibits relatively higher accuracy around a cosine similarity value of approximately 0.6 compared to other architectures. Additionally, under the noise-based protection scheme, a limited accuracy rebound occurs in the cosine similarity range of approximately 0.85–0.9. In contrast, the replacement-based protection scheme effectively suppresses classification performance across all models while maintaining comparatively higher cosine similarity, demonstrating more stable semantic feature disruption behavior [21].

5.4. Robustness Test

We evaluated model robustness under JPEG compression (jpeg70), random cropping (crop90), and Gaussian blur ($\sigma =1$). Figure 6 presents the robust accuracy of each model under these transformations.

The experimental results show that Transformer-based models (Swin-B, ViT-B16, and DeiT-B16) generally achieved higher robust accuracy than CNN-based models (ResNet50, EfficientNet-B0, and MobileNet-V2). In particular, Swin-B achieved the highest robustness to spatial transformation, recording a robust accuracy of 0.633 under crop90. ViT-B16 also maintained stable performance under jpeg70 and crop90, achieving robust accuracy values of 0.52 and 0.51, respectively.

In contrast, ResNet50 exhibited relatively low robust accuracy (0.13–0.16). However, as shown in

Table 3. Robustness of the ResNet-50 model under common image transformations, including JPEG compression, cropping, and blurring. Both the classification accuracy (robust accuracy) and the cosine similarity between clean and protected images are reported for each transformation. This table demonstrates that PIS-protected images retain certain feature characteristics while still inducing a controlled degradation in model performance.

Transform	Robust_ACC	Cosine_Similarity
jpeg 70	0.13	0.74
crop 90	0.16	0.79
blur	0.14	0.77

, cosine similarity remained comparatively high across transformations. This observation suggests that although feature representations remain relatively stable after transformation, the final decision boundary may still be sensitive to input perturbations [22]. In other words, representation-level similarity does not necessarily guarantee classification robustness [23].

These findings indicate that architectures based on global self-attention may exhibit relatively stronger robustness to compression and spatial transformations than CNN architectures that rely primarily on local receptive fields.

Figure 7 compares protected accuracy under JPEG compression and cropping conditions across different protection ratios (replace_pos75_neg25, replace_pos50_neg50, and replace_pos25_neg75).

Across all models, clean accuracy remained high (0.85–1.0), while protected accuracy was consistently maintained within a low range (0.06–0.13). This demonstrates that the proposed protection mechanism preserves classification performance on clean data while intentionally reducing accuracy for protected samples.

Under JPEG transformations, Swin-B and DeiT-B16 exhibited relatively higher protected accuracy compared to CNN-based models. This tendency may be attributed to the ability of Transformer architectures to integrate broader contextual information via global self-attention, making them relatively less sensitive to local high-frequency distortions introduced by JPEG compression. Even when fine-grained details are partially degraded, global structural information may still be preserved, allowing the protection signal to remain partially effective.

Furthermore, DeiT-B16 showed comparatively higher protected accuracy under the crop0.8 condition. As a Vision Transformer-based model, DeiT-B16 tokenizes images into patches and models global relationships through self-attention [24]. When the central region is preserved, as in crop0.8, global contextual information may still be effectively utilized [17]. This behavior is consistent with prior findings that self-attention mechanisms capture global dependencies beyond local receptive fields [25]. In contrast, CNN-based models may experience greater degradation of protection signals when spatial regions are partially removed.

Importantly, even under relatively strong transformations such as JPEG50 and crop0.8, protected accuracy remained within the range of 0.04–0.24. This result indicates that the proposed method retains a certain degree of protection persistence against common image manipulations.

Overall, the proposed protection mechanism demonstrates stable performance under realistic image transformation scenarios.

5.5. Confusion Matrix Analysis

Figure 2 reveals a critical failure mode induced by the proposed PIS that extends beyond a simple reduction in classification accuracy. For clean images, misclassifications are largely concentrated among semantically related classes, forming structured confusion patterns. In contrast, predictions for noise- and replacement-based protected images lose this semantic organization, collapsing toward a small subset of classes or becoming irregularly distributed. This behavior indicates that the observed performance degradation is not merely caused by increased uncertainty, but rather reflects a collapse of semantic understanding. By preserving the global appearance of the image while disrupting relevance-critical regions, PIS prevents models from exploiting class-discriminative features, resulting in predictions that no longer align with semantic class relationships.

5.6. Quantitative Summary

Table 4. Summary of PIS results for each model. The parameters $\alpha$ and $\beta$ denote the application ratios of noise and replacement, respectively.

Model	Solution	$\mathit{\alpha }$	$\mathit{\beta }$	Acc_Clean	Acc_Protected	Psnr_Mean	Ssim_Mean	Cosine_Flat_Mean
DeiT-B/16	noise	0	100	1.0	0.086667	14.69491	0.31905	0.892694
		10	90	1.0	0.073333	12.81076	0.298929	0.856513
		25	75	1.0	0.113333	10.95512	0.262094	0.799997
		50	50	1.0	0.16	8.781365	0.190377	0.698234
		75	25	1.0	0.186667	7.265331	0.106383	0.594237
	replace	0	100	1.0	0.066667	14.83456	0.322423	0.902163
		10	90	1.0	0.066667	14.20433	0.316984	0.896518
		25	75	1.0	0.106667	13.24701	0.291286	0.878652
		50	50	1.0	0.133333	11.60145	0.238551	0.830264
		75	25	1.0	0.166667	10.22888	0.186854	0.770565
Swin-b	noise	0	100	1.0	0.22	14.69491	0.31905	0.892694
		10	90	1.0	0.166667	12.81076	0.298929	0.856513
		25	75	1.0	0.133333	10.95512	0.262094	0.799997
		50	50	1.0	0.18	8.781365	0.190377	0.698234
		75	25	1.0	0.493333	7.265331	0.106383	0.594237
	replace	0	100	1.0	0.22	14.83456	0.322423	0.902163
		10	90	1.0	0.146667	14.20433	0.316984	0.896518
		25	75	1.0	0.206667	13.24701	0.291286	0.878652
		50	50	1.0	0.253333	11.60145	0.238551	0.830264
		75	25	1.0	0.52	10.22888	0.186854	0.770565
ViT-B/16	noise	0	100	1.0	0.08	14.69491	0.31905	0.892694
		10	90	1.0	0.106667	12.81076	0.298929	0.856513
		25	75	1.0	0.1	10.95512	0.262094	0.799997
		50	50	1.0	0.153333	8.781365	0.190377	0.698234
		75	25	1.0	0.233333	7.265331	0.106383	0.594237
	replace	0	100	1.0	0.113333	14.83456	0.322423	0.902163
		10	90	1.0	0.093333	14.20433	0.316984	0.896518
		25	75	1.0	0.12	13.24701	0.291286	0.878652
		50	50	1.0	0.153333	11.60145	0.238551	0.830264
		75	25	1.0	0.16	10.22888	0.186854	0.770565
resnet50	noise	0	100	0.86	0.08	14.69491	0.31905	0.892694
		10	90	0.86	0.106667	12.81076	0.298929	0.856513
		25	75	0.86	0.1	10.95512	0.262094	0.799997
		50	50	0.86	0.1	8.781365	0.190377	0.698234
		75	25	0.86	0.1	7.265331	0.106383	0.594237
	replace	0	100	0.86	0.073333	14.83456	0.322423	0.902163
		10	90	0.86	0.153333	14.20433	0.316984	0.896518
		25	75	0.86	0.186667	13.24701	0.291286	0.878652
		50	50	0.86	0.126667	11.60145	0.238551	0.830264
		75	25	0.86	0.1	10.22888	0.186854	0.770565
EfficientNet	noise	0	100	0.993333	0.093333	14.69491	0.31905	0.892694
		10	90	0.993333	0.113333	12.81076	0.298929	0.856513
		25	75	0.993333	0.12	10.95512	0.262094	0.799997
		50	50	0.993333	0.16	8.781365	0.190377	0.698234
		75	25	0.993333	0.186667	7.265331	0.106383	0.594237
	replace	0	100	0.993333	0.093333	14.83456	0.322423	0.902163
		10	90	0.993333	0.146667	14.20433	0.316984	0.896518
		25	75	0.993333	0.126667	13.24701	0.291286	0.878652
		50	50	0.993333	0.16	11.60145	0.238551	0.830264
		75	25	0.993333	0.14	10.22888	0.186854	0.770565
MobileNet	noise	0	100	1.0	0.12	14.69491	0.31905	0.892694
		10	90	1.0	0.126667	12.81076	0.298929	0.856513
		25	75	1.0	0.1	10.95512	0.262094	0.799997
		50	50	1.0	0.1	8.781365	0.190377	0.698234
		75	25	1.0	0.1	7.265331	0.106383	0.594237
	replace	0	100	1.0	0.12	14.83456	0.322423	0.902163
		10	90	1.0	0.153333	14.20433	0.316984	0.896518
		25	75	1.0	0.166667	13.24701	0.291286	0.878652
		50	50	1.0	0.126667	11.60145	0.238551	0.830264
		75	25	1.0	0.12	10.22888	0.186854	0.770565

summarizes the quantitative evaluation metrics, including classification accuracy on clean images (acc_clean), classification accuracy after retraining on PIS-protected images (acc_protected), average PSNR and SSIM values, and average cosine similarity between flattened feature vectors. All evaluated models achieve near-perfect classification accuracy on clean images. However, when protected images are used as inputs, a substantial performance degradation is consistently observed. For instance, the DeiT-B/16 model maintains an accuracy of 1.0 on clean images, while its average accuracy drops to 0.116 when evaluated on PIS-protected images. Importantly, this degradation occurs even when visual quality is not completely destroyed. For the DeiT-B/16 model, the average PSNR and SSIM values of noise-based protected images are 9.95 and 0.21, respectively, while replacement-based protection yields higher values of 12.32 and 0.26 under non-zero protection ratios. These results indicate that the protected images remain perceptually recognizable to human observers while becoming unreliable inputs for deep learning models. Overall, the experimental results demonstrate that the proposed PIS framework effectively disrupts deep learning-based classification performance while minimizing perceptual degradation. This confirms the practicality of PIS as a copyright protection mechanism that preserves human interpretability while preventing unauthorized model exploitation.

5.7. Evaluation of Protected Images

Table 2 summarizes the quantitative experimental results obtained by applying three PIS protection variants (noise, replace, and texture) to the ImageNet-100, CIFAR-10, and CIFAR-100 (Subset) datasets. The reported metrics include classification accuracy, prediction confidence, entropy, and image similarity measures (SSIM and PSNR), enabling a joint analysis of learning disruption and perceptual preservation. For ImageNet-100, all protection variants reduce the classification accuracy to approximately 9.1%, indicating a substantial degradation of learning and generalization performance. Compared to noise-based protection, the replace and texture variants exhibit lower mean confidence and higher entropy, suggesting increased predictive uncertainty. Despite this disruption, SSIM and PSNR values remain relatively stable, confirming that the global structure and perceptual quality of the images are largely preserved after protection.

In the case of CIFAR-10, classification accuracy collapses to zero for all protection variants. This behavior does not indicate random guessing, but rather reflects a failure of the model to learn discriminative features from the protected images. This interpretation is further supported by the consistently high entropy values observed across all variants. SSIM and PSNR metrics are not reported for CIFAR-10. This is because, in the CIFAR-10 experiments, protected images were generated and consumed on-the-fly within the training pipeline, without being stored as paired image samples aligned with their clean counterparts at identical resolutions. As a result, pixel-wise correspondence required for SSIM and PSNR computation could not be established.

For the CIFAR-100 (Subset) experiments, which represent an extreme low-data regime, all protection variants again lead to complete accuracy collapse. Compared to ImageNet-100, the average confidence is significantly reduced, while entropy remains at a moderate level, indicating strong learning disruption under limited data conditions. At the same time, SSIM and PSNR values remain relatively high, demonstrating that perceptual similarity is preserved even when the dataset size is severely constrained. Overall, these results quantitatively demonstrate that PIS consistently induces learning collapse across datasets of varying resolutions and scales, while maintaining perceptual integrity from a human perspective.

6. Discussion

An important observation from the experimental results is that the classification accuracy on protected images (acc_protected) decreases substantially even when the cosine similarity between feature representations of clean and protected images remains relatively high. This result suggests that the proposed protection mechanism does not induce arbitrary or global distortions in the feature space. Instead, it selectively interferes with localized feature components that are crucial for the final classification decision [21,24].

In general, deep learning-based image classifiers rely on a limited subset of highly discriminative features embedded in high-dimensional representation spaces. Through the use of Layer-wise Relevance Propagation (LRP), the proposed Predictable-Image Solution (PIS) explicitly identifies these critical features and applies targeted modifications to the corresponding image regions. As a result, the overall orientation of the feature vectors is largely preserved, leading to high cosine similarity, while the discriminative information required to cross decision boundaries is effectively disrupted. This explains why similarity-based metrics alone are insufficient to capture the degradation in classification performance.

Compared with conventional protection approaches based on global noise injection or uniform distortion, PIS achieves a favorable trade-off between perceptual fidelity and learning disruption. The protected images remain visually similar to the original ones from a human perspective, while the inference performance of pre-trained models is significantly degraded. This characteristic underscores the suitability of PIS as a practical copyright protection mechanism in real-world scenarios, where preserving visual quality is often as important as preventing unauthorized model exploitation.

7. Limitations of the Study

Despite the overall effectiveness of the proposed approach, several limitations should be acknowledged. First, under certain protection configurations, an unexpected increase in the average classification accuracy on protected images was observed. This indicates that stronger protection does not necessarily lead to a monotonic degradation of classification performance. Instead, the interaction between structured feature replacement and model architecture may exhibit nonlinear behavior. In particular, when highly discriminative local regions are modified, some models may compensate by relying on alternative global or statistical cues.

This phenomenon is especially relevant for Transformer-based architectures, where global self-attention mechanisms enable holistic information aggregation. Under specific configurations, the redistribution of attention triggered by the protection process may unintentionally enhance inter-class separability rather than suppress it. These results suggest that representation-level adaptation can partially offset localized disruption, emphasizing the need for architecture-aware protection strategies.

Second, this study employed fixed protection ratios, and configurations involving full replacement of positively relevant regions were excluded. A protection ratio of 100% would result in the complete loss of visual semantics due to full image substitution, making it impractical for real-world applications. However, using fixed ratios may not fully explore the optimal trade-off between protection strength and semantic preservation. Consequently, some configurations may not fully exploit maximum protection potential, while others may allow partial recovery of classification performance. Overall, these findings indicate that effective copyright protection in deep learning systems requires deeper consideration of representation dynamics and model-dependent adaptation behaviors.

8. Conclusions

In this study, we proposed the Predictable-Image Solution (PIS), a copyright protection framework that selectively modifies visually critical regions identified through Layer-wise Relevance Propagation (LRP). Unlike conventional protection methods based on indiscriminate noise injection or global distortion, PIS introduces structured and decision-aware transformations that directly target discriminative features learned during model training.

Experimental results demonstrate that the proposed approach significantly degrades the classification accuracy of pre-trained models while maintaining relatively high cosine similarity between the feature representations of original and protected images. This indicates that PIS disrupts model decision processes without relying on excessive perceptual degradation.

Furthermore, the observed discrepancy between feature-space similarity and classification performance highlights the importance of targeting decision-relevant regions rather than merely altering visual appearance. The architecture-dependent behaviors identified in certain models further suggest that protection effectiveness is closely tied to underlying representation mechanisms. Overall, PIS provides a practical and model-agnostic strategy for protecting copyrighted images in modern machine learning pipelines and establishes a foundation for explainability-driven data protection.

9. Future Works

Future research will concentrate on advancing adaptive protection strategies that dynamically adjust protection strength according to model architecture and dataset characteristics. Analyzing relevance redistribution patterns may enable the design of architecture-aware masking mechanisms that achieve more consistent degradation across diverse model families.

Another important direction involves the development of automated parameter optimization techniques that balance protection effectiveness with perceptual quality constraints. Integrating perceptual similarity metrics into the optimization framework could allow dynamic determination of replacement intensity while preserving semantic coherence.

In addition, the proposed framework will be extended beyond image classification to broader learning paradigms, including generative models, self-supervised learning, and multimodal systems. Investigating the behavior of relevance-guided protection within large-scale generative AI models will be crucial for evaluating its practical applicability in real-world scenarios.

This study primarily evaluates the effectiveness of the PIS protection framework in image classification models. However, copyright issues are also increasingly relevant for generative models such as diffusion models and GANs, which are trained on large-scale image datasets. In such scenarios, selectively perturbing discriminative visual regions may limit the ability of generative models to directly reproduce specific visual characteristics of protected images. Investigating the applicability and effectiveness of PIS in generative model training therefore remains an important direction for future work.