mlsanityData to 14 Oct 2026

MMA-Diffusion: MultiModal Attack on Diffusion Models

arXiv 2311.17516 ↗First posted 29 Nov 2023cs.CR cs.CVcited by 194

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

In recent years, Text-to-Image (T2I) models have seen remarkable advancements, gaining widespread adoption. However, this progress has inadvertently opened avenues for potential misuse, particularly in generating inappropriate or Not-Safe-For-Work (NSFW) content. Our work introduces MMA-Diffusion, a framework that presents a significant and realistic threat to the security of T2I models by effectively circumventing current defensive measures in both open-source models and commercial online services. Unlike previous approaches, MMA-Diffusion leverages both textual and visual modalities to bypass safeguards like prompt filters and post-hoc safety checkers, thus exposing and highlighting the vulnerabilities in existing defense mechanisms.

Key facts. Cited by 194 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 30 of its 40 references that are in the map. First posted on arXiv 29 Nov 2023.

Builds on

30 of 40 references.

Closest ancestors · 12

Same direction, newest first

  1. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now18 Oct
  2. 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?16 Oct
  3. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks16 Jun
  4. 2023On the Robustness of Latent Diffusion Models14 Jun
  5. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models23 May
  6. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
  7. 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
  8. 2023Erasing Concepts from Diffusion Models13 Mar
  9. 2023Raising the Cost of Malicious AI-Powered Image Editing13 Feb
  10. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples9 Feb
  11. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
  12. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 18

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  2. 2023Segment Anythingcited by 8,234
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  7. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
  8. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  9. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,614
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  12. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
6 more
  1. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  2. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  3. 2023Holistic Evaluation of Text-To-Image Modelscited by 160
  4. 2022Can Machines Help Us Answering Question 16 in Datasheets, and In Turn Reflecting on Inappropriate Content?cited by 155
  5. 2023Black Box Adversarial Prompting for Foundation Modelscited by 62
  6. 2022TextGrad: Advancing Robustness Evaluation in NLP by Gradient-Driven Optimizationcited by 21

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 36; 2025: 75; 2026: 83.

194 papers.

Sort:

By area:

  1. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generationcited by 133
  2. 2025Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrailscited by 132
  3. 2024Latent Guard: a Safety Framework for Text-to-image Generationcited by 71
  4. 2024T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Modelscited by 66
  5. 2024GuardT2I: Defending Text-to-Image Models from Adversarial Promptscited by 62
  6. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Modelcited by 58
  7. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 58
  8. 2024ConceptPrune: Concept Editing in Diffusion Models via Skilled Neuron Pruningcited by 55
  9. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 51
  10. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 40
  11. 2024Precise, Fast, and Low-cost Concept Erasure in Value Space: Orthogonal Complement Matterscited by 40
  12. 2024RIGID: A Training-free and Model-Agnostic Framework for Robust AI-Generated Image Detectioncited by 36
38 more
  1. 2025SPEED: Scalable, Precise, and Efficient Concept Erasure for Diffusion Modelscited by 36
  2. 2024ART: Automatic Red-teaming for Text-to-Image Models to Protect Benign Userscited by 35
  3. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
  4. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  5. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  6. 2024Separable Multi-Concept Erasure from Diffusion Modelscited by 28
  7. 2024Fuzz-Testing Meets LLM-Based Agents: An Automated and Efficient Framework for Jailbreaking Text-To-Image Generation Modelscited by 27
  8. 2025CURE: Concept Unlearning via Orthogonal Representation Editing in Diffusion Modelscited by 27
  9. 2024TraSCE: Trajectory Steering for Concept Erasurecited by 26
  10. 2024Faster-GCG: Efficient Discrete Optimization Jailbreak Attacks against Aligned Large Language Modelscited by 25
  11. 2024Holistic Unlearning Benchmark: A Multi-Faceted Evaluation for Text-to-Image Diffusion Model Unlearningcited by 21
  12. 2025Training-Free Safe Denoisers for Safe Use of Diffusion Modelscited by 21
  13. 2025T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attackscited by 21
  14. 2024AlignGuard: Scalable Safety Alignment for Text-to-Image Generationcited by 20
  15. 2025T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Modelscited by 18
  16. 2025PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Modelscited by 17
  17. 2025T2I-RiskyPrompt: A Benchmark for Safety Evaluation, Attack, and Defense on Text-to-Image Modelcited by 17
  18. 2024Efficient Fine-Tuning and Concept Suppression for Pruned Diffusion Modelscited by 16
  19. 2025TRCE: Towards Reliable Malicious Concept Erasure in Text-to-Image Diffusion Modelscited by 15
  20. 2025VideoEraser: Concept Erasure in Text-to-Video Diffusion Modelscited by 14
  21. 2024Unlearning or Concealment? A Critical Analysis and Evaluation Metrics for Unlearning in Diffusion Modelscited by 13
  22. 2024Multimodal Pragmatic Jailbreak on Text-to-image Modelscited by 13
  23. 2025Detect-and-Guide: Self-regulation of Diffusion Models for Safe Text-to-Image Generation via Guideline Token Optimizationcited by 13
  24. 2025Componential Prompt-Knowledge Alignment for Domain Incremental Learningcited by 13
  25. 2025Minimalist Concept Erasure in Generative Modelscited by 13
  26. 2024Concept Arithmetics for Circumventing Concept Inhibition in Diffusion Modelscited by 12
  27. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  28. 2025Jailbreaking on Text-to-Video Models via Scene Splitting Strategycited by 12
  29. 2024Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Stepcited by 11
  30. 2024Unveiling Concept Attribution in Diffusion Modelscited by 11
  31. 2025Concept Corrector: Erase concepts on the fly for text-to-image diffusion modelscited by 11
  32. 2026When Safety Collides: Resolving Multi-Category Harmful Conflicts in Text-to-Image Diffusion via Adaptive Safety Guidancecited by 11
  33. 2024SteerDiff: Steering towards Safe Text-to-Image Diffusion Modelscited by 10
  34. 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion modelscited by 10
  35. 2024DiffGuard: Text-Based Safety Checker for Diffusion Modelscited by 10
  36. 2025Erasing Concepts, Steering Generations: A Comprehensive Survey of Concept Suppressioncited by 10
  37. 2025Image Can Bring Your Memory Back: A Novel Multi-Modal Guided Attack against Image Generation Model Unlearningcited by 10
  38. 2024Six-CD: Benchmarking Concept Removals for Benign Text-to-image Diffusion Modelscited by 9

50 most cited of 194 All 194 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2026Disciplined Diffusion: Text-to-Image Diffusion Model against NSFW Generation
  2. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts
  3. 2025Beautiful Images, Toxic Words: Understanding and Addressing Offensive Text in Generated Images
  4. 2025Comprehensive Assessment and Analysis for NSFW Content Erasure in Text-to-Image Diffusion Models
  5. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attacks
  6. 2025Comprehensive Evaluation and Analysis for NSFW Concept Erasure in Text-to-Image Diffusion Models
  7. 2024When Image Generation Goes Wrong: A Safety Analysis of Stable Diffusion Models
  8. 2026RAPID: A Real-Time Defense Against Unauthorized Model Distillation for Text-to-Image Services