mlsanityData to 7 Oct 2026

A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion

arXiv 2303.16378 ↗First posted 29 Mar 2023cs.CVcited by 75

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Despite the record-breaking performance in Text-to-Image (T2I) generation by Stable Diffusion, less research attention is paid to its adversarial robustness. In this work, we study the problem of adversarial attack generation for Stable Diffusion and ask if an adversarial text prompt can be obtained even in the absence of end-to-end model queries. We call the resulting problem 'query-free attack generation'. To resolve this problem, we show that the vulnerability of T2I models is rooted in the lack of robustness of text encoders, e.g., the CLIP text encoder used for attacking Stable Diffusion. Based on such insight, we propose both untargeted and targeted query-free attacks, where the former is built on the most influential dimensions in the text embedding space, which we call steerable key dimensions. By leveraging the proposed attacks, we empirically show that only a five-character perturbation to the text prompt is able to cause the significant content shift of synthesized images using Stable Diffusion. Moreover, we show that the proposed target attack can precisely steer the diffusion model to scrub the targeted image content without causing much change in untargeted image content. Our code is available at https://github.com/OPTML-Group/QF-Attack.

Key facts. Cited by 75 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 36 of its 43 references that are in the map. First posted on arXiv 29 Mar 2023.

Builds on

36 of 43 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Raising the Cost of Malicious AI-Powered Image Editing13 Feb
  2. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  3. 2022Guided Diffusion Model for Adversarial Purification30 May
  4. 2022Diffusion Models for Adversarial Purification16 May

Other references · 32

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
  7. 2022Classifier-Free Diffusion Guidancecited by 5,717
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
20 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  2. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  3. 2021Solving Inverse Problems in Medical Imaging with Score-Based Generative Modelscited by 514
  4. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  5. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  6. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  7. 2015YFCC100M: The New Data in Multimedia Researchcited by 234
  8. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  9. 2018Spatially Transformed Adversarial Examplescited by 195
  10. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  11. 2020Robust Pre-Training by Adversarial Contrastive Learningcited by 144
  12. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
  13. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Modelscited by 117
  14. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  15. 2018Structured Adversarial Attack: Towards General Implementation and Better Interpretabilitycited by 63
  16. 2022Discovering the Hidden Vocabulary of DALLE-2cited by 42
  17. 2021Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neuronscited by 29
  18. 2022TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimizationcited by 21
  19. 2021Generating Adversarial Computer Programs using Optimized Obfuscationscited by 20
  20. 2022ADIR: Adaptive Diffusion for Image Reconstructioncited by 20

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 15; 2024: 26; 2025: 23; 2026: 11.

75 papers.

Sort:

By area:

  1. 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?cited by 239
  2. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Nowcited by 204
  3. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 184
  4. 2024Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Modelscited by 164
  5. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Modelscited by 68
  6. 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 68
  7. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 57
  8. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 37
  9. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 34
  10. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  11. 2023Discovering Failure Modes of Text-guided Diffusion Models via Adversarial Searchcited by 25
  12. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attackscited by 24
38 more
  1. 2023On the Robustness of Latent Diffusion Modelscited by 21
  2. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  3. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimizationcited by 19
  4. 2024Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editingcited by 19
  5. 2023I See Dead People: Gray-Box Adversarial Attack on Image-To-Text Modelscited by 17
  6. 2023Realistic Human Motion Generation with Cross-Diffusion Modelscited by 17
  7. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  8. 2024FMM-Attack: A Flow-based Multi-modal Adversarial Attack on Video-based LLMscited by 14
  9. 2024InstructG2I: Synthesizing Images from Multimodal Attributed Graphscited by 14
  10. 2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
  11. 2024ProTIP: Probabilistic Robustness Verification on Text-to-Image Diffusion Models against Stochastic Perturbationcited by 10
  12. 2024SteerDiff: Steering towards Safe Text-to-Image Diffusion Modelscited by 10
  13. 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion modelscited by 10
  14. 2024Practical Region-level Attack against Segment Anything Modelscited by 9
  15. 2025Token-Level Constraint Boundary Search for Jailbreaking Text-to-Image Modelscited by 9
  16. 2025Red-Teaming Text-to-Image Systems by Rule-based Preference Modelingcited by 8
  17. 2025PLA: Prompt Learning Attack against Text-to-Image Generative Modelscited by 8
  18. 2024Video Watermarking: Safeguarding Your Video from (Unauthorized) Annotations by Video-based LLMscited by 7
  19. 2024Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motioncited by 7
  20. 2025SafeText: Safe Text-to-image Models via Aligning the Text Encodercited by 7
  21. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  22. 2025Towards Safe Synthetic Image Generation On the Web: A Multimodal Robust NSFW Defense and Million Scale Datasetcited by 6
  23. 2025AutoPrompt: Automated Red-Teaming of Text-to-Image Models via LLM-Driven Adversarial Promptscited by 6
  24. 2026CtrlAttack: A Unified Attack on World-Model Control in Diffusion Modelscited by 6
  25. 2023VA3: Virtually Assured Amplification Attack on Probabilistic Copyright Protection for Text-to-Image Generative Modelscited by 5
  26. 2023Asymmetric Bias in Text-to-Image Generation with Adversarial Attackscited by 5
  27. 2025Dynamic Optimization and Safety Indicator Injection for Jailbreaking Text-to-Image Models with Multimodal Safety Filterscited by 5
  28. 2025DREAM: Scalable Red Teaming for Text-to-Image Generative Systems via Distribution Modelingcited by 5
  29. 2025Universally Unfiltered and Unseen:Input-Agnostic Multimodal Jailbreaks against Text-to-Image Model Safeguardscited by 5
  30. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Modelscited by 5
  31. 2026Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filterscited by 5
  32. 2024Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Imagescited by 4
  33. 2024Discovering Universal Semantic Triggers for Text-to-Image Synthesiscited by 3
  34. 2024The Power of Few: Accelerating and Enhancing Data Reweighting with Coreset Selectioncited by 3
  35. 2024Buster: Implanting Semantic Backdoor into Text Encoder to Mitigate NSFW Content Generationcited by 3
  36. 2025Wukong Framework for Not Safe For Work Detection in Text-to-Image systemscited by 3
  37. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  38. 2025Erased, But Not Forgotten: Erased Rectified Flow Transformers Still Remain Unsafe Under Concept Attackcited by 3

50 most cited of 75 All 75 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Revealing Vulnerabilities in Stable Diffusion via Targeted Attacks
  2. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Models
  3. 2024Safeguarding Text-to-Image Generation via Inference-Time Prompt-Noise Optimization
  4. 2024Adversarial Robustification via Text-to-Image Diffusion Models
  5. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Model
  6. 2023Improving Adversarial Transferability by Stable Diffusion
  7. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attacks
  8. 2026Test-Time Scaling for Safe Text-Guided Image Generation via Intermediate Clean Estimates