mlsanityData to 7 Oct 2026

Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey

arXiv 2408.03400 ↗First posted 6 Aug 2024cs.CR cs.AI cs.LGcited by 32

On the map: Diffusion models → Robustness, privacy and adversarial aspects

also in 1 more
Abstract (arXiv)

Diffusion models (DMs) have achieved state-of-the-art performance on various generative tasks such as image synthesis, text-to-image, and text-guided image-to-image generation. However, the more powerful the DMs, the more harmful they potentially are. Recent studies have shown that DMs are prone to a wide range of attacks, including adversarial attacks, membership inference, backdoor injection, and various multi-modal threats. Since numerous pre-trained DMs are published widely on the Internet, potential threats from these attacks are especially detrimental to the society, making DM-related security a worth investigating topic. Therefore, in this paper, we conduct a comprehensive survey on the security aspect of DMs, focusing on various attack and defense methods for DMs. First, we present crucial knowledge of DMs with five main types of DMs, including denoising diffusion probabilistic models, denoising diffusion implicit models, noise conditioned score networks, stochastic differential equations, and multi-modal conditional DMs. We further survey a variety of recent studies investigating different types of attacks that exploit the vulnerabilities of DMs. Then, we thoroughly review potential countermeasures to mitigate each of the presented threats. Finally, we discuss open challenges of DM-related security and envision certain research directions for this topic.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 152 of its 181 references that are in the map. First posted on arXiv 6 Aug 2024.

Builds on

152 of 181 references.

Closest ancestors · 49

Same direction, newest first

  1. 2024Pruning for Robust Concept Erasing in Diffusion Models26 May
  2. 2024Towards Black-Box Membership Inference Attack for Diffusion Models25 May
  3. 2024R.A.C.E.: Robust Adversarial Concept Erasure for Secure Text-to-Image Diffusion Model25 May
  4. 2024Unlearning Concepts in Diffusion Model via Concept Domain Correction and Concept Preserving Gradient24 May
  5. 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancy23 May
  6. 2024Erasing Concepts from Text-to-Image Diffusion Models with Few-shot Unlearning12 May
  7. 2024Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models15 Apr
  8. 2024DisDet: Exploring Detectability of Backdoor Attack on Diffusion Models5 Feb
  9. 2024Revealing Vulnerabilities in Stable Diffusion via Targeted Attacks16 Jan
  10. 2024The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipeline7 Jan
  11. 2023One-Dimensional Adapter to Rule Them All: Concepts, Diffusion Models and Erasing Applications26 Dec
  12. 2023All but One: Surgical Concept Erasing with Model Preservation in Text-to-Image Diffusion Models20 Dec
37 more
  1. 2023Black-box Membership Inference Attacks against Fine-tuned Diffusion Models13 Dec
  2. 2023Membership Inference Attacks on Diffusion Models via Quantile Regression8 Dec
  3. 2023Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Erasers29 Nov
  4. 2023MMA-Diffusion: MultiModal Attack on Diffusion Models29 Nov
  5. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift27 Nov
  6. 2023Generated Distributions Are All You Need for Membership Inference Attacks Against Generative Models30 Oct
  7. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification27 Oct
  8. 2023To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now18 Oct
  9. 2023Prompting4Debugging: Red-Teaming Text-to-Image Diffusion Models by Finding Problematic Prompts12 Sep
  10. 2023White-box Membership Inference Attacks against Diffusion Models11 Aug
  11. 2023Degeneration-Tuning: Using Scrambled Grid shield Unwanted Concepts from Stable Diffusion2 Aug
  12. 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Models22 Jun
  13. 2023Evaluating the Robustness of Text-to-image Diffusion Models against Real-world Attacks16 Jun
  14. 2023On the Robustness of Latent Diffusion Models14 Jun
  15. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models12 Jun
  16. 2023Privacy Distillation: Reducing Re-identification Risk of Multimodal Diffusion Models2 Jun
  17. 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initialization26 May
  18. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Models23 May
  19. 2023Mist: Towards Improved Adversarial Examples for Diffusion Models22 May
  20. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Models20 May
  21. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models18 May
  22. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning7 May
  23. 2023Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models30 Mar
  24. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusion29 Mar
  25. 2023Anti-DreamBooth: Protecting users from personalized text-to-image synthesis27 Mar
  26. 2023Ablating Concepts in Text-to-Image Diffusion Models23 Mar
  27. 2023Erasing Concepts from Diffusion Models13 Mar
  28. 2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targets10 Mar
  29. 2023Raising the Cost of Malicious AI-Powered Image Editing13 Feb
  30. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples9 Feb
  31. 2023Membership Inference Attacks against Diffusion Models7 Feb
  32. 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?2 Feb
  33. 2023Extracting Training Data from Diffusion Models30 Jan
  34. 2023Membership Inference of Diffusion Models24 Jan
  35. 2022How to Backdoor Diffusion Models?11 Dec
  36. 2022Safe Latent Diffusion: Mitigating Inappropriate Degeneration in Diffusion Models9 Nov
  37. 2022Red-Teaming the Stable Diffusion Safety Filter3 Oct

Other references · 103

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  6. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  7. 2020Denoising Diffusion Implicit Modelscited by 9,655
  8. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  9. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  10. 2020End-to-End Object Detection with Transformerscited by 7,384
  11. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  12. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
38 more
  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  3. 2016XGBoost: A Scalable Tree Boosting Systemcited by 5,120
  4. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  5. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  6. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  7. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  8. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  9. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  10. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,286
  11. 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,229
  12. 2022DreamFusion: Text-to-3D using 2D Diffusioncited by 3,006
  13. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  14. 2016Deep Learning with Differential Privacycited by 2,682
  15. 2016Visual Genome: Connecting Language and Vision Using Crowdsourced Dense Image Annotationscited by 2,646
  16. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  17. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  18. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,231
  19. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  20. 2015Variational Inference with Normalizing Flowscited by 2,161
  21. 2015Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networkscited by 2,048
  22. 2021Structured Denoising Diffusion Models in Discrete State-Spacescited by 1,665
  23. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  24. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,544
  25. 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,447
  26. 2022RePaint: Inpainting using Denoising Diffusion Probabilistic Modelscited by 1,419
  27. 2022Magic3D: High-Resolution Text-to-3D Content Creationcited by 1,285
  28. 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,107
  29. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  30. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  31. 2019Machine Unlearningcited by 1,020
  32. 2022Diffusion Models in Vision: A Surveycited by 1,008
  33. 2022Diffusion-LM Improves Controllable Text Generationcited by 1,006
  34. 2021Blended Diffusion for Text-driven Editing of Natural Imagescited by 924
  35. 2021Membership Inference Attacks From First Principlescited by 839
  36. 2021Diffusion Probabilistic Models for 3D Point Cloud Generationcited by 734
  37. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  38. 2021Score-based Generative Modeling in Latent Spacecited by 634

50 most cited of 103 All 103 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 16; 2026: 12.

32 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  2. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  3. 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion modelscited by 10
  4. 2025A Comprehensive Survey on Concept Erasure in Text-to-Image Diffusion Modelscited by 9
  5. 2026When Safety Collides: Resolving Multi-Category Harmful Conflicts in Text-to-Image Diffusion via Adaptive Safety Guidancecited by 9
  6. 2024PureDiffusion: Using Backdoor to Counter Backdoor in Generative Diffusion Modelscited by 6
  7. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  8. 2025Anti-Diffusion: Preventing Abuse of Modifications of Diffusion-Based Modelscited by 6
  9. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Modelscited by 5
  10. 2025My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swappingcited by 4
  11. 2026VidLeaks: Membership Inference Attacks Against Text-to-Video Modelscited by 4
  12. 2025A Dual-Purpose Framework for Backdoor Defense and Backdoor Amplification in Diffusion Modelscited by 3
20 more
  1. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  2. 2025Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Modelscited by 2
  3. 2025BadReward: Clean-Label Poisoning of Reward Models in Text-to-Image RLHFcited by 2
  4. 2025M-ErasureBench: A Comprehensive Multimodal Evaluation Benchmark for Concept Erasure in Diffusion Modelscited by 2
  5. 2026Inference Attacks Against Graph Generative Diffusion Modelscited by 2
  6. 2026SafeRoPE: Risk-specific Head-wise Embedding Rotation for Safe Generation in Rectified Flow Transformerscited by 2
  7. 2025Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Modelscited by 1
  8. 2025SoK: Can Synthetic Images Replace Real Data? A Survey of Utility and Privacy of Synthetic Image Generationcited by 1
  9. 2025SecureT2I: No More Unauthorized Manipulation on AI Generated Images from Promptscited by 1
  10. 2025ZIUM: Zero-Shot Intent-Aware Adversarial Attack on Unlearned Modelscited by 1
  11. 2025Defending Diffusion Models Against Membership Inference Attacks via Higher-Order Langevin Dynamicscited by 1
  12. 2026BlackMirror: Black-Box Backdoor Detection for Text-to-Image Models via Instruction-Response Deviationcited by 1
  13. 2026Evaluation without Generation: Non-Generative Assessment of Harmful Model Specialization with Applications to CSAMcited by 1
  14. 2025BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Modelscited by 0
  15. 2026Universal Adversarial Purification with DDIM Metric Loss for Stable Diffusioncited by 0
  16. 2026Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scalingcited by 0
  17. 2026Watch Your Step: Information Injection in Diffusion Models via Shadow Timestep Embeddingcited by 0
  18. 2026TooBad: Backdoor Diffusion Models with Ultra-Low Poison Rate and Imperceptible Triggercited by 0
  19. 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalitiescited by 0
  20. 2026Adaptive Diffusion Freezing: Privacy-preserving Diffusion Models Against Membership Inference Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  2. 2023Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models
  3. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds
  4. 2024Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think
  5. 2023From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models
  6. 2024Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models
  7. 2025Explore the vulnerability of black-box models via diffusion models
  8. 2025Practical, Generalizable and Robust Backdoor Attacks on Text-to-Image Diffusion Models