mlsanityData to 14 Oct 2026

Asymmetric Bias in Text-to-Image Generation with Adversarial Attacks

arXiv 2312.14440 ↗First posted 22 Dec 2023cs.LG cs.CRcited by 5

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

The widespread use of Text-to-Image (T2I) models in content generation requires careful examination of their safety, including their robustness to adversarial attacks. Despite extensive research on adversarial attacks, the reasons for their effectiveness remain underexplored. This paper presents an empirical study on adversarial attacks against T2I models, focusing on analyzing factors associated with attack success rates (ASR). We introduce a new attack objective - entity swapping using adversarial suffixes and two gradient-based attack algorithms. Human and automatic evaluations reveal the asymmetric nature of ASRs on entity swap: for example, it is easier to replace "human" with "robot" in the prompt "a human dancing in the rain." with an adversarial suffix, but the reverse replacement is significantly harder. We further propose probing metrics to establish indicative signals from the model's beliefs to the adversarial ASR. We identify conditions that result in a success probability of 60% for adversarial attacks and others where this likelihood drops below 5%.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 36 of its 59 references that are in the map. First posted on arXiv 22 Dec 2023.

Builds on

36 of 59 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Adversarial Prompt Tuning for Vision-Language Models19 Nov
  2. 2023Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?16 Oct
  3. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  4. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 32

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020Language Models are Few-Shot Learnerscited by 32,419
  4. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  7. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  8. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  11. 2013Intriguing properties of neural networkscited by 5,155
  12. 2013Auto-Encoding Variational Bayescited by 4,053
20 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2022Reproducible scaling laws for contrastive language-image learningcited by 1,173
  3. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  4. 2017Adversarial Patchcited by 517
  5. 2023SugarCrepe: Fixing Hackable Benchmarks for Vision-Language Compositionalitycited by 243
  6. 2022What the DAAM: Interpreting Stable Diffusion Using Cross Attentioncited by 236
  7. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
  8. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  9. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 183
  10. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Modelscited by 175
  11. 2018Are adversarial examples inevitable?cited by 113
  12. 2018Benchmarking Neural Network Robustness to Common Corruptions and Surface Variationscited by 99
  13. 2023The Generative AI Paradox: "What It Can Create, It May Not Understand"cited by 98
  14. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 76
  15. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
  16. 2023Understanding the Effectiveness of Large Language Models in Detecting Security Vulnerabilitiescited by 59
  17. 2023How Trustworthy are Open-Source LLMs? An Assessment under Malicious Demonstrations Shows their Vulnerabilitiescited by 33
  18. 2021Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neuronscited by 29
  19. 2023Scaling Laws for Adversarial Attacks on Language Model Activationscited by 19
  20. 2023Why do universal adversarial attacks work on large language models?: Geometry might be the answercited by 14

Built on by

Cited by year

Citing papers per year: 2024: 4; 2025: 1.

5 papers.

  1. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Surveycited by 35
  2. 2024Moderator: Moderating Text-to-Image Diffusion Models through Fine-grained Context-based Policiescited by 15
  3. 2024Espresso: Robust Concept Filtering in Text-to-Image Modelscited by 14
  4. 2024One Prompt to Verify Your Models: Black-Box Text-to-Image Models Verification via Non-Transferable Adversarial Attackscited by 4
  5. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Attacks on Parts of Speech: An Empirical Study in Text-to-Image Generation
  2. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks
  3. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Models
  4. 2023Adversarial Nibbler: A Data-Centric Challenge for Improving the Safety of Text-to-Image Models
  5. 2024Adversarial Nibbler: An Open Red-Teaming Method for Identifying Diverse Harms in Text-to-Image Generation
  6. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Model
  7. 2024Backdooring Bias (B2) into Stable Diffusion Models
  8. 2025PLA: Prompt Learning Attack against Text-to-Image Generative Models