mlsanityData to 14 Oct 2026

BSPA: Exploring Black-box Stealthy Prompt Attacks against Image Generators

arXiv 2402.15218 ↗First posted 23 Feb 2024cs.CR cs.CL cs.CVcited by 7

Not on the map. Why?

Abstract (arXiv)

Extremely large image generators offer significant transformative potential across diverse sectors. It allows users to design specific prompts to generate realistic images through some black-box APIs. However, some studies reveal that image generators are notably susceptible to attacks and generate Not Suitable For Work (NSFW) contents by manually designed toxin texts, especially imperceptible to human observers. We urgently need a multitude of universal and transferable prompts to improve the safety of image generators, especially black-box-released APIs. Nevertheless, they are constrained by labor-intensive design processes and heavily reliant on the quality of the given instructions. To achieve this, we introduce a black-box stealthy prompt attack (BSPA) that adopts a retriever to simulate attacks from API users. It can effectively harness filter scores to tune the retrieval space of sensitive words for matching the input prompts, thereby crafting stealthy prompts tailored for image generators. Significantly, this approach is model-agnostic and requires no internal access to the model's features, ensuring its applicability to a wide range of image generators. Building on BSPA, we have constructed an automated prompt tool and a comprehensive prompt attack dataset (NSFWeval). Extensive experiments demonstrate that BSPA effectively explores the security vulnerabilities in a variety of state-of-the-art available black-box models, including Stable Diffusion XL, Midjourney, and DALL-E 2/3. Furthermore, we develop a resilient text filter and offer targeted recommendations to ensure the security of image generators against prompt attacks in the future.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 25 of its 31 references that are in the map. First posted on arXiv 23 Feb 2024.

Builds on

25 of 31 references.

References · 25

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  7. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  8. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,152
  9. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  10. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  11. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,555
  12. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
13 more
  1. 2021Solving Inverse Problems in Medical Imaging with Score-Based Generative Modelscited by 521
  2. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Modelscited by 513
  3. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  4. 2022Red-Teaming the Stable Diffusion Safety Filtercited by 264
  5. 2022Black-Box Tuning for Language-Model-as-a-Servicecited by 256
  6. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Modelscited by 175
  7. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  8. 2022DALL-E-Bot: Introducing Web-Scale Diffusion Models to Roboticscited by 106
  9. 2023Evil Geniuses: Delving into the Safety of LLM-based Agentscited by 106
  10. 2023Towards Safe Self-Distillation of Internet-Scale Text-to-Image Diffusion Modelscited by 41
  11. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  12. 2022Black-box Few-shot Knowledge Distillationcited by 14
  13. 2023Beyond the ML Model: Applying Safety Engineering Frameworks to Text-to-Image Developmentcited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 2; 2025: 4; 2026: 1.

7 papers.

  1. 2024T2VSafetyBench: Evaluating the Safety of Text-to-Video Generative Modelscited by 66
  2. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  3. 2025Jailbreaking on Text-to-Video Models via Scene Splitting Strategycited by 12
  4. 2025Jailbreaking Safeguarded Text-to-Image Models via Large Language Modelscited by 5
  5. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  6. 2025Rethinking Robust Adversarial Concept Erasure in Diffusion Modelscited by 1
  7. 2026The Price of Consistency: Exploiting Visual Anchors for Multimodal Jailbreaking in Video Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025PLA: Prompt Learning Attack against Text-to-Image Generative Models
  2. 2026Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection
  3. 2025Prompt Pirates Need a Map: Stealing Seeds helps Stealing Prompts
  4. 2025PROMPTMINER: Black-Box Prompt Stealing against Text-to-Image Generative Models via Reinforcement Learning and Fuzz Optimization
  5. 2024DiffZOO: A Purely Query-Based Black-Box Attack for Red-teaming Text-to-Image Generative Model via Zeroth Order Optimization
  6. 2025PromptGuard: Soft Prompt-Guided Unsafe Content Moderation for Text-to-Image Models
  7. 2025Towards Safe Synthetic Image Generation On the Web: A Multimodal Robust NSFW Defense and Million Scale Dataset
  8. 2024Universal Prompt Optimizer for Safe Text-to-Image Generation