摘要：要求一款商业图像编辑器预览某项整形手术时，它往往会改变比请求所指定范围更多的面部内容：例如鼻部编辑还可能平滑皮肤或改变光照。现有将编辑限制在单一区域的方法需要访问模型内部机制，而公开编辑 API 并不提供这种访问权限。我们研究仅依靠客户端究竟能实现多大程度的控制。在一项试点基准测试中，六种商业编辑配置和一种基于掩码的图像修补模型，分别在三种客户端控制级别下执行拉皮式下颌—颈部编辑和隆鼻编辑：仅使用提示词；从响应结果中裁出编辑区域，再通过基于人脸关键点生成的掩码将其贴回原始照片（掩码合成）；以及在支持的情况下，要求模型自行在掩码内部进行图像修补。在 210 次尝试编辑中，196 次可被评分。研究使用 ArcFace 余弦值衡量身份保持情况；使用 CIELAB 像素变化比例衡量变化有多少落在请求区域内，而非受保护的面部区域。在区域指标能够评分的 12 张正脸照片上，与配对的仅提示词输出相比，掩码合成将局部化程度的中位数提高了 0.446（按人脸聚类的 95% bootstrap 区间为 0.421–0.457），同时对请求区域的改动幅度大致相同。不同编辑器在编辑强度和身份保留之间存在差异，而我们测试的唯一一款图像修补模型并未优于这一简单合成方法。相对于每张人脸的输入照片至术后照片基线，没有任何编辑器能使其输出在身份嵌入指标上更接近术后照片。这是一项关于控制能力而非临床准确性的研究：没有外科医生对输出结果进行评分，且每种条件仅生成一次。在这一范围内，将手术预览限制于其预定区域并不需要访问模型；客户端上的掩码与合成操作能够以较低的服务商成本，在所有测试编辑器中强制实现这一限制。

Abstract:Ask a commercial image editor to preview a cosmetic procedure and it will often change more of the face than the request names: a nose edit can also smooth skin or alter lighting. Existing methods for confining an edit to one region require access to the model's internals, which a public editing API does not expose. We ask how much control is possible from the client side alone. In a pilot benchmark, six commercial editing configurations and one mask-based inpainting model perform facelift-style jaw-neck and rhinoplasty edits at three levels of client-side control: the prompt alone; cutting the edited region out of the response and pasting it back onto the original photograph through a landmark-derived mask (a masked composite); and asking the model itself to inpaint inside the mask where supported. Of 210 attempted edits, 196 could be scored. ArcFace cosine measures identity preservation; a CIELAB pixel-change ratio measures how much change lands inside the requested region rather than a protected facial zone. On the 12 frontal faces the regional metric could score, the masked composite improved localization over the paired prompt-only output by a median of 0.446 (95% face-clustered bootstrap interval 0.421-0.457) while changing the requested region about as much. Editors differed in edit strength versus identity retention, and the one inpainting model we tested did not beat the simple composite. Against each face's input-to-postoperative baseline, no editor moved its outputs closer to the postoperative photograph in identity-embedding terms. This is a study of control, not clinical accuracy: no surgeons rated the outputs, and each condition was generated once. Within that scope, keeping a surgical preview inside its intended region needs no access to the model; a mask and composite on the client enforce it across every editor tested, at low provider cost.