mlsanityData to 7 Oct 2026

Stable Diffusion is Unstable

arXiv 2306.02583 ↗First posted 5 Jun 2023cs.CVcited by 27

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Recently, text-to-image models have been thriving. Despite their powerful generative capacity, our research has uncovered a lack of robustness in this generation process. Specifically, the introduction of small perturbations to the text prompts can result in the blending of primary subjects with other categories or their complete disappearance in the generated images. In this paper, we propose Auto-attack on Text-to-image Models (ATM), a gradient-based approach, to effectively and efficiently generate such perturbations. By learning a Gumbel Softmax distribution, we can make the discrete process of word replacement or extension continuous, thus ensuring the differentiability of the perturbation generation. Once the distribution is learned, ATM can sample multiple attack samples simultaneously. These attack samples can prevent the generative model from generating the desired subjects without compromising image quality. ATM has achieved a 91.1% success rate in short-text attacks and an 81.2% success rate in long-text attacks. Further empirical analysis revealed four attack patterns based on: 1) the variability in generation speed, 2) the similarity of coarse-grained characteristics, 3) the polysemy of words, and 4) the positioning of words.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 30 of its 41 references that are in the map. First posted on arXiv 5 Jun 2023.

Builds on

30 of 41 references.

References · 30

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  6. 2023GPT-4 Technical Reportcited by 18,132
  7. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  8. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  9. 2020Denoising Diffusion Implicit Modelscited by 9,655
  10. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  11. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  12. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,466
18 more
  1. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  2. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  3. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2022Video Diffusion Modelscited by 2,280
  6. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  7. 2023T2I-Adapter: Learning Adapters to Dig out More Controllable Ability for Text-to-Image Diffusion Modelscited by 1,339
  8. 2023Attend-and-Excite: Attention-Based Semantic Guidance for Text-to-Image Diffusion Modelscited by 696
  9. 2023Structure and Content-Guided Video Synthesis with Diffusion Modelscited by 589
  10. 2022Latent-NeRF for Shape-Guided Generation of 3D Shapes and Texturescited by 506
  11. 2022Training-Free Structured Diffusion Guidance for Compositional Text-to-Image Synthesiscited by 386
  12. 2023Composer: Creative and Controllable Image Synthesis with Composable Conditionscited by 303
  13. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  14. 2022What the DAAM: Interpreting Stable Diffusion Using Cross Attentioncited by 233
  15. 2022MM-Diffusion: Learning Multi-Modal Diffusion Models for Joint Audio and Video Generationcited by 225
  16. 2023NUWA-XL: Diffusion over Diffusion for eXtremely Long Video Generationcited by 170
  17. 2022Deep Model Reassemblycited by 78
  18. 2023Knowledge Diffusion for Distillationcited by 51

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 13; 2025: 8; 2026: 5.

27 papers.

Sort:

By area:

  1. 2024MindBridge: A Cross-Subject Brain Decoding Frameworkcited by 65
  2. 2024CoMat: Aligning Text-to-Image Diffusion Model with Image-to-Text Concept Matchingcited by 60
  3. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 59
  4. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 34
  5. 2024Make-Your-3D: Fast and Consistent Subject-Driven 3D Content Generationcited by 32
  6. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  7. 2024RealCompo: Balancing Realism and Compositionality Improves Text-to-Image Diffusion Modelscited by 18
  8. 2024GenMix: Effective Data Augmentation with Generative Diffusion Model Image Editingcited by 14
  9. 2024ProTIP: Probabilistic Robustness Verification on Text-to-Image Diffusion Models against Stochastic Perturbationcited by 10
  10. 2024Revealing Vulnerabilities in Stable Diffusion via Targeted Attackscited by 8
  11. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  12. 2024Relation Rectification in Diffusion Modelcited by 6
15 more
  1. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  2. 2025Probabilistic Robustness in Deep Learning: A Concise yet Comprehensive Guidecited by 6
  3. 2025Wukong Framework for Not Safe For Work Detection in Text-to-Image systemscited by 3
  4. 2024Interactive Visual Assessment for Text-to-Image Generation Modelscited by 1
  5. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Modelscited by 1
  6. 2025Image-to-Brain Signal Generation for Visual Prosthesis with CLIP Guided Multimodal Diffusion Modelscited by 1
  7. 2025HAVIR: HierArchical Vision to Image Reconstruction using CLIP-Guided Versatile Diffusioncited by 1
  8. 2026EPIG: Emotion-Based Prompting for Personalised Image Generationcited by 1
  9. 2025Dig2DIG: Dig into Diffusion Information Gains for Image Fusioncited by 0
  10. 2025HAVIR: HierArchical Vision to Image Reconstruction using CLIP-Guided Versatile Diffusioncited by 0
  11. 2025CAHS-Attack: CLIP-Aware Heuristic Search Attack Method for Stable Diffusioncited by 0
  12. 2026Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generationcited by 0
  13. 2026ELDiff: When Evidential Learning Meets Text-to-Image Diffusioncited by 0
  14. 2026Virtual Ring Try-Oncited by 0
  15. 2026Concept Score Relearning: A Unified Cross-Architecture Attack on Concept Erasurecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks
  2. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attacks
  3. 2024Understanding Implosion in Text-to-Image Generative Models
  4. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion
  5. 2024Safeguarding Text-to-Image Generation via Inference-Time Prompt-Noise Optimization
  6. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis
  7. 2024Jailbreaking Prompt Attack: A Controllable Adversarial Attack against Diffusion Models
  8. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models