[Paper Review] Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey

Chenyu Zhang, Mingwang Hu+2 more|arXiv (Cornell University)|Jul 10, 2024

Digital Media Forensic Detection4 citations

TL;DR

This survey provides a comprehensive analysis of adversarial attacks and defenses targeting text-to-image diffusion models, categorizing attack methods by their impact on model robustness and safety. It identifies critical vulnerabilities—such as sensitivity to grammatically incorrect prompts and subtle noise—and evaluates defense strategies, highlighting gaps in handling imperceptible adversarial prompts and the need for adaptive, pattern-based defenses.

ABSTRACT

Recently, the text-to-image diffusion model has gained considerable attention from the community due to its exceptional image generation capability. A representative model, Stable Diffusion, amassed more than 10 million users within just two months of its release. This surge in popularity has facilitated studies on the robustness and safety of the model, leading to the proposal of various adversarial attack methods. Simultaneously, there has been a marked increase in research focused on defense methods to improve the robustness and safety of these models. In this survey, we provide a comprehensive review of the literature on adversarial attacks and defenses targeting text-to-image diffusion models. We begin with an overview of text-to-image diffusion models, followed by an introduction to a taxonomy of adversarial attacks and an in-depth review of existing attack methods. We then present a detailed analysis of current defense methods that improve model robustness and safety. Finally, we discuss ongoing challenges and explore promising future research directions. For a complete list of the adversarial attack and defense methods covered in this survey, please refer to our curated repository at https://github.com/datar001/Awesome-AD-on-T2IDM.

Motivation & Objective

• To systematically review adversarial attacks targeting text-to-image diffusion models, focusing on robustness and safety vulnerabilities.
• To analyze existing attack methods that exploit grammatical errors, subtle noise, and semantic perturbations in prompts.
• To evaluate current defense mechanisms, distinguishing between external and internal safeguards for safety and robustness.
• To identify key limitations in existing defenses, especially their ineffectiveness against imperceptible adversarial prompts.
• To outline future research directions, including LLM-based multi-agent frameworks and pattern-driven defense strategies.

Proposed method

• Proposes a taxonomy of adversarial attacks based on their impact on model robustness (e.g., multi-object generation failure) and safety (e.g., bypassing content filters).
• Classifies attack methods into prompt-level perturbations, such as adding noise words, typos, or phonetic substitutions, and LLM-generated adversarial prompts.
• Reviews defense strategies, including fine-tuning the CLIP text encoder with adversarial prompts and model editing techniques to preserve core functionality.
• Evaluates external defenses (e.g., prompt detection/correction) and internal defenses (e.g., modifying model parameters to resist malicious outputs).
• Analyzes the trade-off between maintaining CLIP’s pre-trained semantic capabilities and adapting it to adversarial inputs through targeted fine-tuning or parameter editing.
• Proposes leveraging discovered patterns in adversarial prompts as a foundation for future, more generalizable defense mechanisms.

Experimental results

Research questions

• RQ1 What are the primary vulnerabilities in text-to-image diffusion models related to prompt robustness and safety?
• RQ2 How do different types of adversarial prompt perturbations—such as typos, noise words, or LLM-generated rewrites—affect model output?
• RQ3 Why are current defense methods ineffective against untargeted attacks involving subtle, grammatically incorrect prompts?
• RQ4 Can pattern recognition of adversarial prompts enable more robust and generalizable defense mechanisms?
• RQ5 What role can LLM-based multi-agent systems play in automating the generation of highly imperceptible adversarial attacks?

Key findings

• Stable Diffusion and similar models exhibit significant sensitivity to minor prompt perturbations, such as inserting five random characters, which drastically alter generated image content.
• Existing defenses are largely ineffective against adversarial prompts that omit explicit malicious keywords but still generate harmful outputs, especially when using semantic obfuscation.
• Fine-tuning the CLIP text encoder with adversarial prompts risks degrading its foundational cross-modal understanding, highlighting the need for parameter-efficient editing methods.
• Current defense mechanisms show limited success against word-level perturbations and LLM-crafted adversarial prompts, indicating a gap in adaptive, generalizable protection.
• Model editing techniques offer a promising alternative to full fine-tuning, enabling targeted correction of adversarial behaviors while preserving core model capabilities.
• The emergence of LLM-based multi-agent systems suggests a viable path toward automating sophisticated adversarial prompt generation, necessitating advanced defense strategies.